Reference and developer docs

Sub-topics

• Cortex XSIAM XQL
  • Get started with XQL
    • XQL language features
    • XQL Language Structure
    • Supported operators
    • Datasets and presets
    • About examples
    • JSON functions
    • How to filter for empty values in the results table
    • Understanding string manipulation in XQL
  • Build XQL queries
    • About the Query Builder
    • How to build XQL queries
      • Get started with XQL queries
      • Useful XQL user interface features
      • XQL Query best practices
      • Expected results when querying fields
      • Create XQL query
      • Review XQL query results
      • Translate to XQL
      • Graph query results
    • Query Builder templates
      • Get started with Query Builder templates
      • Considerations for using Query Builder templates
      • Create a query from a template
      • Run a free text query
      • Query Builder template examples
    • Overview of the Query Center
      • Edit and run queries in Query Center
      • Query Center reference information
    • Manage scheduled queries
      • Scheduled Queries reference information
    • Manage your personal query library
    • XQL macros
    • Manage your macros
    • Federated Search
      • Federated Search configuration
      • Query using Federated Search
      • Manage external datasets
    • Legacy Query Builder
      • Create authentication query
      • Create event log query
      • Create file query
      • Create image load query
      • Create network connections query
      • Create network query
      • Create process query
      • Create registry query
      • Query across all entities
  • Cortex XQL syntax, parameters, and examples
• Graph Search
  • What is Graph Search?
  • Get started with Graph Search queries
  • How to build Graph Search queries?
  • Understand Graph Search query results
  • Create Graph Search query
  • Graph Search examples
  • Manage the Graph Search Query Library
  • Edit and run queries in Query Center
  • Supported assets and findings
  • FAQ on Graph Search
  • Create detection rules based on graph search
• About Cortex CLI
  • Connect Cortex CLI
    • Installation workflows
    • Manage the CLI after installation
    • Authenticate credentials
    • Self-service API keys for CLI scans
  • Cortex CLI usage
  • Cortex CLI common command line reference guide
  • Cortex CLI for Code Security
    • Cortex CLI usage for Cortex Cloud Application Security
    • Cortex CLI Cortex Cloud Application Security command line reference
      • Custom Cortex checks and signature verification
    • Cortex CLI pre-commit hooks
      • Pre-commit hook usage
    • Cortex CLI pre-receive hooks
      • Pre-receive hook usage
  • Cortex CLI for Cloud Workload Protection
    • Cloud Workload Protection command line reference
  • Cortex CLI for API Security
    • Cortex CLI API Security command line reference guide
      • API Security scan report schema
      • API Security scan output example
• Role-Based Access Control
  • Role permissions by component
  • Core tenant and administrative permissions
  • Configuration permissions
    • Auditing permissions
    • Alert Notifications permissions
    • General Configuration permissions
    • Cortex XDR Analytics permissions
    • Access management permissions
    • Data Broker permissions
    • Log Collection permissions
    • Data Sources permissions
    • External Issues Mapping permissions
    • Integrations - instance permissions
    • Integrations Permissions
    • Data Management permissions
    • Public API
    • Threat Intelligence permission - API configuration
    • Long-running HTTP Integrations configuration
    • Credentials permissions
    • Network Scanners permissions
    • Apps - Instance permissions
    • Object Setup permissions
      • Case Properties permissions
      • Exclusion List permissions
      • Fields and Types permissions
      • Layout permissions
      • Sync Profile permissions
  • Marketplace permissions
  • Help permissions
  • SOC Operations, Investigation & Response permissions
  • Dashboards and Reports permissions
    • Dashboards permissions
    • Command Center Dashboard permissions
    • Ingestion Monitoring dashboard permissions
    • Reports permissions
    • Email Command Center permissions
    • Cloud Security Command Center permissions
  • Cases and Issues permissions
  • Investigation and Response permissions
    • Search permissions
      • Query Library permissions
      • Query Center permissions
      • Forensics permissions
      • Host Insights permissions
      • Graph Search permissions
    • Response permissions
      • Action Center permissions
      • EDL permissions
      • Agent Scripts Library permissions
      • Live Terminal permissions
    • Automation permissions
      • Playbook permissions
      • Script permissions
      • Jobs permissions
      • Playground permissions
      • Automation Exclusion Center permissions
  • Jupyter and Observability apps permissions
  • Threat Management permissions
    • Detection Rules permissions
    • Threat Intelligence permissions
  • Exceptions Configuration permissions
    • Issue Exclusions permissions
    • Exception Management Admin permissions
    • Exception Approver Admin permissions
  • Managed Services permissions
  • Cortex Agentic Assistant permissions
    • AI Prompts
    • Cortex Agentic Assistant Agents
  • Agents and endpoint protection
  • Inventory - Agent permissions
    • Agent Administrations
    • Agent Groups
    • Agent Prevention Policies
    • Global Exceptions
    • Agent Profiles
    • Agent Extension Policies
    • Agent Installations
    • Host Firewall
    • Device Control
  • Data Security - Endpoint DLP permissions
    • Data-in-Motion Rules
    • Endpoint Applications
    • Endpoint Applications Groups
    • Endpoint DLP Settings
  • Inventory - Assets permissions
    • Network Configuration permissions
    • Compliance (Legacy) permissions
    • Asset Inventory permissions
    • Asset Roles configuration permissions
    • Asset Groups permissions
  • Exposure and Vulnerability Management permissions
    • Attack Surface permissions
    • Vulnerability Management permissions
    • Exposure Management permissions
  • Cloud Security and Posture Management permissions
    • CLI Tool permissions
    • Application Security permissions
      • Application Security - Generic Collector permissions
      • Application Security - Issues permissions
      • Application Security - Scans permissions
      • Application Security - Policy Management permissions
      • Application Security - 3rd Party tools permissions
      • Configurations - Application Security permissions
    • Policies - Cloud Workload permissions
    • Cloud Security permissions
    • Compliance - Cloud permissions
    • Data Security permissions
    • AI Security permissions
    • Data Classification permissions
    • Identity Security permissions
• API documentation
• Reference
  • Cloud service provider permissions
  • Microsoft Windows security auditing setup
    • Enable security auditing event IDs
      • Enable security auditing event IDs with GPO
      • Set up local machine security auditing without GPO
      • Additional setup for Active Directory Certificate Services (ADCS) events
      • Enable auditing access to AD domain objects - 4662
    • Enable additional event logs using Event Viewer
    • Enable LDAP server events logging (1644)
      • Enable LDAP server events logging using RegEdit
      • Enable LDAP server events logging using GPO
      • Validate log collection for LDAP Server events
  • XDM fields for mapping authentication events
  • Cortex Network Scanner OSS
  • Fair Usage policy for Cortex XSIAM