Onboard Cortex XSIAM

Sub-topics

• How to onboard Cortex XSIAM
• Plan and prepare
  • Plan your agent deployment
• Deployment steps
  • Cortex XSIAM onboarding checklist
  • Activate Cortex XSIAM
    • Bring your own keys
    • Cortex XSIAM supported regions and data residency
    • Enable access to required PANW resources
      • Cortex XSIAM regional egress resources
      • Cortex XSIAM engine outbound IP addresses
      • Cortex XSIAM inbound source IP addresses
      • FedRAMP and US federal Cortex XSIAM required resources
  • Set up users, groups, and roles
    • Manage Cortex XSIAM user groups
    • Assign user roles and groups
  • Set up authentication
    • Authenticate users through the Customer Support Portal
    • Authenticate users using SSO
    • Set up Okta as the Identity Provider Using SAML 2.0
    • Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0
  • Configure content
  • Set up Cloud Identity Engine
  • Install Cortex XDR agents
    • Create an agent installation package
    • Deploy installation packages
    • Endpoint data collection
    • Configure global agent settings
    • Define endpoint groups
    • Manage endpoint profiles
    • Guidelines for keeping Cortex XDR agents and content updated
  • Cortex XSIAM - Analytics
    • Configure Cortex XSIAM network parameters
    • Enable the Analytics Engine and Identity Analytics
  • FedRAMP overview
    • Cortex XSIAM FedRAMP compliance for federal agencies
    • Onboard and configure government cloud environments
    • FedRAMP limitations and supported government cloud regions
• Post-deployment
  • Cortex XSIAM post-deployment checklist
  • Perform health checks
    • Monitor agent operational status in Cortex XSIAM
  • Cortex Marketplace
    • Content packs
    • Install content packs
  • Manage user roles and access management
    • Manage user roles
    • Manage user access
      • User access reference information
    • Manage user scope
    • Manage access to objects
      • Manage access to custom dashboards
      • Manage access to report templates
      • Manage access to playbooks and scripts
      • Manage access to saved queries
  • Dashboards and reports
  • Configure server settings
  • Configure security settings
  • Data and log forwarding
    • Forward logs and data from Cortex XSIAM to external services
      • Configure external applications for forwarding
        • Forward notifications to Amazon SQS
        • Forward notifications to Amazon S3
        • Forward notifications to Splunk
        • Forward notifications to webhook
        • Integrate a syslog receiver
        • Integrate Slack for outbound notifications
      • Configure notification forwarding
      • Set up email notifications for tenant updates
      • Monitor administrative activity
    • Data and log notification formats
      • Management audit log messages
      • Cortex XSIAM issue notification format
      • Agent Audit log notification format
      • Management Audit log notification format
      • Log format for IOC and BIOC issues
      • Analytics log format