Documentation — August 07, 2026

2712 files changed, 181439 insertions, 1 deletions — view the commit on the mirror.

Initial import: 2,711 pages across eight books seeded from the Cortex documentation portal

This is the mirror’s first export, not a day of change: 2,711 of the 2,712 files are additions and the one modification is the generated README.md.
Eight books were seeded — the largest by far is the Cortex XSIAM Documentation at 2,271 pages.
Within XSIAM, Configure Cortex XSIAM accounts for 1,224 pages and Detect, Investigate, and Respond to Threats for another 408.
Nothing here should be read as an upstream edit; the first meaningful docs diff is the following day.

Highlights

The mirror starts from a snapshot, so every page reads as new

There is no prior state to diff against, so no page on this date was actually added, removed or changed upstream.
Eight books were captured, each at its portal path under a book-named directory

Cortex XSIAM Documentation (2,271), Cortex XQL Command Reference (184), Linux Kernel Versions (100), Cortex XSIAM Developer Guide (84), Cortex XDR Agent Administrator Guide (35), Cortex XDR Compatibility Matrix (15), Cortex XQL Schema Reference (10) and Cortex XDR Agent Releases (4).
The Cortex XDR Agent Administrator Guide was pinned at version 9.3

Its 35 pages came from the cortex-xdr-agent/9.3 portal section, the only book seeded from a version-specific section.
Navigation trees were recorded alongside the pages

Eight `.meta/<book>.json` manifests capture each book's navigation and the portal section it was collapsed from, which is what later diffs use to detect added, removed or reordered pages.

Bulk change — 2,712 files. Per-file diffs are not stored for a change this size; view it on the mirror.

Changes

2712 files listed, 1 written up and shaded below.

▸ ▾ Cortex Assistant capabilities added +31 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/cortex-assistant/cortex-assistant-capabilities

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Assistant layout added +24 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/cortex-assistant/cortex-assistant-layout

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Forensics added +7 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Analysis and documentation added +71 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/analysis-and-documentation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Data collection added +3 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Configure collection added +42 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/configure-collection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Hunting added +3 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a hunt added +19 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting/create-a-hunt

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Hunt results added +53 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting/hunt-results

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Hunt status added +7 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting/hunt-status

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Triage added +3 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a triage added +17 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/create-a-triage

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Offline triage collection added +65 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/offline-triage-collection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Triage results added +9 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/triage-results

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Triage status added +5 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/triage-status

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Upload an offline triage package added +13 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/upload-an-offline-triage-package

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Export added +15 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/export

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Forensic investigations added +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/forensic-investigations

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage an investigation added +14 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Close an investigation added +15 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation/close-an-investigation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a new investigation added +16 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation/create-a-new-investigation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Edit an investigation added +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation/edit-an-investigation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ User permissions added +15 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation/user-permissions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate artifacts and assets added +16 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate a file and process hash added +55 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate a host added +93 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-a-host

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate a user added +119 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-a-user

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate an asset added +32 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-an-asset

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate an IP address added +44 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-an-ip-address

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate endpoints added +7 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage endpoints added +29 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/manage-endpoints

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Overview of the Action Center added +20 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/overview-of-the-action-center

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Action Center reference information added +11 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/overview-of-the-action-center/action-center-reference-information

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Initiate and monitor endpoint actions added +40 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/overview-of-the-action-center/initiate-and-monitor-endpoint-actions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Retrieve files from an endpoint added +38 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/retrieve-files-from-an-endpoint

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Retrieve support file password added +27 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/retrieve-support-file-password

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Retrieve support logs from an endpoint added +29 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/retrieve-support-logs-from-an-endpoint

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Scan an endpoint for malware added +35 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/scan-an-endpoint-for-malware

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate files added +14 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Import file hash exceptions added +13 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/import-file-hash-exceptions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage file execution added +23 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/manage-file-execution

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage quarantined files added +41 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/manage-quarantined-files

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Review WildFire analysis details added +32 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/review-wildfire-analysis-details

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate issues added +31 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Causality view added +113 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Causality icons key added +216 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/causality-icons-key

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cloud causality view for audit log issues added +113 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/cloud-causality-view-for-audit-log-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cloud causality view added +74 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/cloud-causality-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Network causality view added +71 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/network-causality-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ SaaS causality view added +66 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/saas-causality-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Timeline added +49 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/timeline

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue card added +67 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-card

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue deduplication added +47 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-deduplication

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue investigation actions added +3 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Add a file path to a malware profile allow list added +16 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/add-a-file-path-to-a-malware-profile-allow-list

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Analyze an issue added +10 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/analyze-an-issue

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Close an issue added +43 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/close-an-issue

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Copy issues added +15 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/copy-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a featured field added +22 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/create-a-featured-field

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create profile exceptions added +12 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/create-profile-exceptions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Exclude an issue added +16 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/exclude-an-issue

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Export issue details to a file added +14 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate contributing events added +15 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/investigate-contributing-events

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Query case and issue data added +27 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/query-case-and-issue-data

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Retrieve additional issue details added +19 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/retrieve-additional-issue-details

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Update issue fields added +48 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/update-issue-fields

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ View generating BIOC or IOC rule added +9 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/view-generating-bioc-or-ioc-rule

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue syncing added +173 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-syncing

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Link or unlink issues from a case added +19 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/link-or-unlink-issues-from-a-case

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Overview of the Issues page added +61 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/overview-of-the-issues-page

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Resolution actions added +9 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/resolution-actions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Run an automation on an issue added +34 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/run-an-automation-on-an-issue

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Use the War Room in an investigation added +163 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Use the Work Plan in an investigation added +50 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Notebooks added +88 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/notebooks

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage datasets in Notebooks added +93 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/notebooks/manage-datasets-in-notebooks

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Notebooks scheduler added +11 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/notebooks/notebooks-scheduler

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Overview of cases added +18 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case and issue domains added +27 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-and-issue-domains

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case lifecycle added +14 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-lifecycle

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case scope and impact added +9 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-scope-and-impact

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case thresholds added +13 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-thresholds

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Overview of case teams and roles added +43 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/overview-of-case-teams-and-roles

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Resolving cases with AI added +18 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/resolving-cases-with-ai

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ What are cases? added +27 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/what-are-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Research a known threat added +27 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/research-a-known-threat

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Response actions added +21 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Collect a memory image added +23 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/collect-a-memory-image

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Initiate a Live Terminal session added +169 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/initiate-a-live-terminal-session

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Isolate an endpoint added +43 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/isolate-an-endpoint

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage external dynamic lists added +93 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/manage-external-dynamic-lists

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Pause endpoint protection added +26 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/pause-endpoint-protection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Remediate changes from malicious activity added +37 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/remediate-changes-from-malicious-activity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Run agent scripts on an endpoint added +259 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/run-agent-scripts-on-an-endpoint

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Search and destroy malicious files added +70 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/search-and-destroy-malicious-files

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Review findings added +46 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/review-findings

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Findings card added +11 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/review-findings/findings-card

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Monitor dashboards and reports added +2 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Access and visibility for dashboards and reports added +10 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Access and sharing cheat sheet added +7 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.