Documentation — August 07, 2026

2712 files changed, 181439 insertions, 1 deletions — view the commit on the mirror.

Initial import: 2,711 pages across eight books seeded from the Cortex documentation portal

This is the mirror’s first export, not a day of change: 2,711 of the 2,712 files are additions and the one modification is the generated README.md.
Eight books were seeded — the largest by far is the Cortex XSIAM Documentation at 2,271 pages.
Within XSIAM, Configure Cortex XSIAM accounts for 1,224 pages and Detect, Investigate, and Respond to Threats for another 408.
Nothing here should be read as an upstream edit; the first meaningful docs diff is the following day.

Highlights

The mirror starts from a snapshot, so every page reads as new

There is no prior state to diff against, so no page on this date was actually added, removed or changed upstream.
Eight books were captured, each at its portal path under a book-named directory

Cortex XSIAM Documentation (2,271), Cortex XQL Command Reference (184), Linux Kernel Versions (100), Cortex XSIAM Developer Guide (84), Cortex XDR Agent Administrator Guide (35), Cortex XDR Compatibility Matrix (15), Cortex XQL Schema Reference (10) and Cortex XDR Agent Releases (4).
The Cortex XDR Agent Administrator Guide was pinned at version 9.3

Its 35 pages came from the cortex-xdr-agent/9.3 portal section, the only book seeded from a version-specific section.
Navigation trees were recorded alongside the pages

Eight `.meta/<book>.json` manifests capture each book's navigation and the portal section it was collapsed from, which is what later diffs use to detect added, removed or reordered pages.

Bulk change — 2,712 files. Per-file diffs are not stored for a change this size; view it on the mirror.

Changes

2712 files listed, 1 written up and shaded below.

▸ ▾ Getting started with the Cortex Advanced Email Security module added +53 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/getting-started-with-the-cortex-advanced-email-security-module

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate and respond to email security issues added +181 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/investigate-and-respond-to-email-security-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Mailbox Inventory added +26 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/mailbox-inventory

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Malicious Email Inventory added +83 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/malicious-email-inventory

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Exposure management added +25 −0 xsiam/detect-investigate-and-respond-to-threats/exposure-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Network Scanner added +492 −0 xsiam/detect-investigate-and-respond-to-threats/exposure-management/cortex-network-scanner

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Exposure Management Command Center added +64 −0 xsiam/detect-investigate-and-respond-to-threats/exposure-management/exposure-management-command-center

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Learn about Exposure Management added +56 −0 xsiam/detect-investigate-and-respond-to-threats/exposure-management/exposure-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Get started with Exposure Management added +20 −0 xsiam/detect-investigate-and-respond-to-threats/exposure-management/get-started-with-exposure-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Ingest assets and vulnerabilities from third-party applications added +45 −0 xsiam/detect-investigate-and-respond-to-threats/exposure-management/ingest-assets-and-vulnerabilities-from-third-party-applications

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Security controls added +222 −0 xsiam/detect-investigate-and-respond-to-threats/exposure-management/security-controls

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Identity Threat Detection and Response (ITDR) added +16 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Improve Active Directory posture with AD-SPM added +54 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/active-directory-security-posture-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage user asset roles added +55 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/asset-roles

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enforce dynamic access control with CAP added +161 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/conditional-access-policy

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Get started with ITDR added +56 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/get-started-with-itdr

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate user risk added +87 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/investigate-user-risk

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage role based access control (RBAC) in ITDR added +12 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/manage-role-based-access-control-rbac-in-itdr

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Monitor user risk exposure added +8 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/monitor-user-risk-exposure

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Prevent malicious LDAP queries added +23 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/prevent-malicious-ldap-queries

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigation and response added +57 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Analyze and resolve cases added +7 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Additional case actions added +2 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Assign a case team and restrict access added +77 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Playbook examples added +146 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a case added +40 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/create-a-case

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Merge a case added +56 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/merge-a-case

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Unified case view added +43 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/unified-case-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Analyze case details added +16 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Associated assets and artifacts added +15 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case timeline added +78 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/case-timeline

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Compliance standards and controls added +26 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Detailed View added +121 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/detailed-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Evidence added +116 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/evidence

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Grouping graph added +38 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/grouping-graph

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue feed added +10 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/issue-feed

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ MITRE ATT&CK tactics and techniques added +11 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Establish case context added +3 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ AI-generated case summaries added +52 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Assess case severity and score added +34 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Update case attributes added +45 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context/update-case-attributes

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Resolve the case added +3 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Collaborative notes and comments added +8 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Response and Remediation content pack added +25 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Example use cases added +34 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/example-use-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate an issue using Cortex Response and Remediation playbooks added +77 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/investigate-an-issue-using-cortex-response-and-remediation-playbooks

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Monitor and track resolution times added +27 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Resolution Center added +43 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-center

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Resolution reasons for cases and issues added +13 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ How to resolve a case added +17 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolve-a-case

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Review all cases added +42 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/review-all-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Start case analysis added +30 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Agentic Assistant- Case Investigation agent added +22 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Build XQL queries added +13 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ About the Query Builder added +33 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/about-the-query-builder

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Federated Search added +42 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Federated Search configuration added +224 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search/federated-search-configuration

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage external datasets added +16 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search/manage-external-datasets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Query using Federated Search added +25 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search/query-using-federated-search

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ How to build XQL queries added +132 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create XQL query added +115 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/create-xql-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Expected results when querying fields added +13 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Get started with XQL queries added +22 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Graph query results added +69 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/graph-query-results

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Review XQL query results added +90 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Translate to XQL added +85 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/translate-to-xql

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Useful XQL user interface features added +16 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ XQL Query best practices added +16 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Legacy Query Builder added +25 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create authentication query added +23 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-authentication-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create event log query added +42 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-event-log-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create file query added +65 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-file-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create image load query added +54 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-image-load-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create network connections query added +67 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-connections-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create network query added +62 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create process query added +65 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-process-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create registry query added +59 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-registry-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Query across all entities added +47 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/query-across-all-entities

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage scheduled queries added +34 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-scheduled-queries

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Scheduled Queries reference information added +17 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage your macros added +55 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-your-macros

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage your personal query library added +89 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-your-personal-query-library

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Overview of the Query Center added +24 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/overview-of-the-query-center

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Edit and run queries in Query Center added +114 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Query Center reference information added +17 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/overview-of-the-query-center/query-center-reference-information

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Query Builder templates added +22 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Considerations for using Query Builder templates added +69 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a query from a template added +74 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/create-a-query-from-a-template

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Get started with Query Builder templates added +7 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/get-started-with-query-builder-templates

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Query Builder template examples added +106 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/query-builder-template-examples

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Run a free text query added +36 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/run-a-free-text-query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ XQL macros added +214 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/xql-macros

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case concepts added +3 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case grouping added +42 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-grouping

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case scoring added +45 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-scoring

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case starring added +7 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-starring

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issues, findings, and events added +54 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/issues-findings-and-events

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ SLAs and tracking added +17 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/slas-and-tracking

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ What is Causality? added +84 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/what-is-causality

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Assistant added +35 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/cortex-assistant

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.