← Platform Changes

Documentation — August 17, 2026

4 files changed, 14 insertions, 13 deletions — view the commit on the mirror.

Highlights

• The root certificate for EDL setup changed from GoDaddy to DigiCert

  The download link moved from `gdroot-g2.crt` to DigiCert Global Root G2, so an EDL configured from the old page trusts the wrong root.

• New Amazon ECS EC2 agent installation package

  The installer downloads as a JSON task definition for agent 9.1 or later on x86_64 or ARM64, and must be deployed as a Daemon service so one agent task runs per container instance.

• Scheduled correlations are capped at 1,200 active rules

  The limit counts only enabled, user-created scheduled correlations and is now stated on both the create and manage pages.

• Data ingestion health monitoring is now labelled BETA

  Three limitations are stated: it does not distinguish ingestion lag from data loss, auto-generated health issues are not dispatched or grouped into cases, and as orphan issues they cannot trigger playbook automation.

• The XQL bin stage gains bins, timeshift and timezone

  `span` is now optional against a new `bins=` count, `timeshift`/`timezone` set the grouping origin — but `comp`, `view` and the stage index all now link to `bin` as `broken-reference`.

• Cortex CLI pages moved under About Cortex CLI

  Sixteen pages were renamed from `cortex-cli/` to `about-cortex-cli/`, with `authenticate-credentials` pushed a level deeper under Connect Cortex CLI and the API Security page rewritten in place.

Changes

4 files listed.

• ▸ ▾ Task 2: Create the app registration for the Azure BYOA outpost modified +0 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-2-create-the-app-registration-for-the-azure-byoa-outpost

  Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

  Before After

  @@ -41,17 +41,16 @@ Before you run the script, confirm that the prerequisites are met. Skipping any

  These prerequisites are required whenever you run the script, regardless of what you are provisioning.

  These prerequisites are required whenever you run the script, regardless of what you are provisioning.

  • Azure CLI: Version 2.x or later, installed on your workstation. The script runs on macOS, Linux, and Windows (via Git Bash or WSL2).

  • Azure CLI: Version 2.x or later, installed on your workstation. The script runs on macOS, Linux, and Windows (via Git Bash or WSL2).

  • Entra ID role: The identity that runs the script must hold the built-in Application Developer role on the tenant where the app registration lives. By default any user can register applications, but if your tenant has disabled user registration, an administrator must grant you this role.

  • Entra ID role: The identity that runs the script must hold the built-in Application Developer role on the tenant where the app registration lives. By default any user can register applications, but if your tenant has disabled user registration, an administrator must grant you this role.

  • Terraform runner object ID: The object ID (a GUID) of the identity that runs terraform apply for this outpost. This is almost always a service principal, not a human user. You will retrieve the object ID in Step 3.

  • Terraform runner object ID: The object ID (a GUID) of the identity that runs terraform apply for this outpost. This is almost always a service principal, not a human user. You will retrieve the object ID in Step 3.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note:</strong> Do not confuse the object ID with the client ID. They are both GUIDs, both are returned by the Azure CLI, and they are not interchangeable.</p></div>

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note:</strong> Do not confuse the object ID with the client ID. They are both GUIDs, both are returned by the Azure CLI, and they are not interchangeable.</p></div>

  • Entra ID tenant: The tenant where you want the app registration to live. This is usually your home tenant, not the tenant that hosts the monitored subscription. The script creates the app registration in whichever tenant your Azure CLI session is signed in to, so signing in to the correct tenant when you perform Step 4 is critical.

  • Entra ID tenant: The tenant where you want the app registration to live. This is usually your home tenant, not the tenant that hosts the monitored subscription. The script creates the app registration in whichever tenant your Azure CLI session is signed in to, so signing in to the correct tenant when you perform Step 4 is critical.

  • Outpost Terraform bundle: Download the Cortex outpost Terraform bundle from the Cortex XSIAM console and extract it. The helper script is located in the bundle at <customer_managed>/app_registration/setup-byo-app-registration.sh.

  #### Also required when creating scanner managed identities

  #### Also required when creating scanner managed identities

  These permissions are required when you also use the script to create scanner managed identities.

  These permissions are required when you also use the script to create scanner managed identities.

  • Azure RBAC roles: The identity that runs the script must hold either Owner on the target subscription, or Contributor plus User Access Administrator on the target subscription, or the equivalent least-privilege combination on a pre-created resource group. For the least-privilege option, see the script's README.md.

  • Azure RBAC roles: The identity that runs the script must hold either Owner on the target subscription, or Contributor plus User Access Administrator on the target subscription, or the equivalent least-privilege combination on a pre-created resource group. For the least-privilege option, see the script's README.md.

  • Subscription, resource group, and region: The Azure subscription ID where the UAMIs go, the name of the resource group to hold them (the script creates the group if it does not exist), and the Azure region for that resource group (for example, australiaeast or eastus).

  • Subscription, resource group, and region: The Azure subscription ID where the UAMIs go, the name of the resource group to hold them (the script creates the group if it does not exist), and the Azure region for that resource group (for example, australiaeast or eastus).

  Show markdown source

  @@ -41,17 +41,16 @@ Before you run the script, confirm that the prerequisites are met. Skipping any
   These prerequisites are required whenever you run the script, regardless of what you are provisioning.
   
   * **Azure CLI:** Version 2.x or later, installed on your workstation. The script runs on macOS, Linux, and Windows (via Git Bash or WSL2).
   * **Entra ID role:** The identity that runs the script must hold the built-in `Application Developer` role on the tenant where the app registration lives. By default any user can register applications, but if your tenant has disabled user registration, an administrator must grant you this role.
   *   **Terraform runner object ID:** The object ID (a GUID) of the identity that runs `terraform apply` for this outpost. This is almost always a service principal, not a human user. You will retrieve the object ID in [Step 3](#shell-script-step-3-look-up-the-terraform-runner-object-id-terminal-azure-cli).
   
       <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note:</strong> Do not confuse the object ID with the client ID. They are both GUIDs, both are returned by the Azure CLI, and they are not interchangeable.</p></div>
   * **Entra ID tenant:** The tenant where you want the app registration to live. This is usually your home tenant, not the tenant that hosts the monitored subscription. The script creates the app registration in whichever tenant your Azure CLI session is signed in to, so signing in to the correct tenant when you perform [Step 4](#shell-script-step-4-sign-in-to-the-correct-entra-id-tenant-terminal-azure-cli) is critical.
  -* **Outpost Terraform bundle:** Download the Cortex outpost Terraform bundle from the Cortex XSIAM console and extract it. The helper script is located in the bundle at `<customer_managed>/app_registration/setup-byo-app-registration.sh`.
   
   #### Also required when creating scanner managed identities
   
   These permissions are required when you also use the script to create scanner managed identities.
   
   * **Azure RBAC roles:** The identity that runs the script must hold either `Owner` on the target subscription, or `Contributor` plus `User Access Administrator` on the target subscription, or the equivalent least-privilege combination on a pre-created resource group. For the least-privilege option, see the script's `README.md`.
   * **Subscription, resource group, and region:** The Azure subscription ID where the UAMIs go, the name of the resource group to hold them (the script creates the group if it does not exist), and the Azure region for that resource group (for example, `australiaeast` or `eastus`).
   
  

• ▸ ▾ Evidence modified +1 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/evidence

  Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

  Before After

  @@ -82,17 +82,17 @@ Expand the causality chain to further investigate in the full **Causality view**

  Graph evidence provides a visual representation of interconnected assets, relationships, and findings that trigger a rule condition. Evaluated against the graph-based engine, it shows the exact path, assets, and attributes involved in an issue.

  Graph evidence provides a visual representation of interconnected assets, relationships, and findings that trigger a rule condition. Evaluated against the graph-based engine, it shows the exact path, assets, and attributes involved in an issue.

  #### Attack path vs. graph issues

  #### Attack path vs. graph issues

  You can view connected asset paths on the interactive graph canvas for both issue types, but they differ based on who created the rule and how the issue is categorized:
  

  You can view connected asset paths on the interactive graph canvas for both issue types, but they differ based on who created the rule and how the issue is categorized:
  

  • Attack path issues: Triggered by Out-of-the-Box (OOTB) Rules. They detail specific exploit trajectories, from entry points to sensitive targets.

  • Attack path issues: Triggered by Out-of-the-Box (OOTB) Rules. They detail specific exploit trajectories, from entry points to sensitive targets.

  • Graph issues: Triggered by Graph Rules. They visualize cross-domain posture findings, asset dependencies, and custom graph queries. For more information, see Create a graph rule.

  • Graph issues: Triggered by Graph Rules. They visualize cross-domain posture findings, asset dependencies, and custom graph queries. For more information, see Create detection rules based on graph search.

  #### Locating & Reviewing Graph Evidence

  #### Locating & Reviewing Graph Evidence

  You can find Graph Engine issues in the Issues table using these filters:
  

  You can find Graph Engine issues in the Issues table using these filters:
  

  • Issue Domain: Posture

  • Issue Domain: Posture

  • Detection Method: Graph Engine

  • Detection Method: Graph Engine

  • Issue Category: Attack Path (OOTB rules) or Cross Domain Detection (Custom rules)
  

  • Issue Category: Attack Path (OOTB rules) or Cross Domain Detection (Custom rules)
  

  Show markdown source

  @@ -82,17 +82,17 @@ Expand the causality chain to further investigate in the full **Causality view**
   
   Graph evidence provides a visual representation of interconnected assets, relationships, and findings that trigger a rule condition. Evaluated against the graph-based engine, it shows the exact path, assets, and attributes involved in an issue.
   
   #### Attack path vs. graph issues
   
   You can view connected asset paths on the interactive graph canvas for both issue types, but they differ based on who created the rule and how the issue is categorized:<br>
   
   * **Attack path issues:** Triggered by Out-of-the-Box (OOTB) Rules. They detail specific exploit trajectories, from entry points to sensitive targets.
  -* **Graph issues:** Triggered by Graph Rules. They visualize cross-domain posture findings, asset dependencies, and custom graph queries. For more information, see [Create a graph rule](../../../../cloud-security/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-graph-rule).
  +* **Graph issues:** Triggered by Graph Rules. They visualize cross-domain posture findings, asset dependencies, and custom graph queries. For more information, see [Create detection rules based on graph search](../../../../reference-and-developer-docs/graph-search/create-detection-rules-based-on-graph-search).
   
   #### Locating & Reviewing Graph Evidence
   
   You can find Graph Engine issues in the Issues table using these filters:<br>
   
   * **Issue Domain:** Posture
   * **Detection Method:** Graph Engine
   * **Issue Category:** Attack Path (OOTB rules) or Cross Domain Detection (Custom rules)<br>
  

• ▸ ▾ Cortex XSIAM product licenses modified +1 −1 xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses

  Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

  Before After

  @@ -46,15 +46,15 @@ Existing users who have a Cortex XSIAM Enterprise Plus license retain all Cortex

  Some add-ons, such as Advanced Email Security and Exposure Management, are only available for Cortex XSIAM Premium, Enterprise, and NG-SIEM licenses.

  Some add-ons, such as Advanced Email Security and Exposure Management, are only available for Cortex XSIAM Premium, Enterprise, and NG-SIEM licenses.

  endhint

  endhint

  tabs

  tabs

  tab Capabilities and add-ons

  tab Capabilities and add-ons

  Cortex offers a modular set of license packages that work interchangeably with each other, allowing them to become add-ons to subsequent products seamlessly. The table below shows the breakdown of each type of license package:

  Cortex offers a modular set of license packages that work interchangeably with each other, allowing them to become add-ons to subsequent products seamlessly. The table below shows the breakdown of each type of license package:

  Feature	Description	Cortex XSIAM NG SIEM	Cortex XSIAM Enterprise	Cortex XSIAM Premium
  Core Analytics	Detects anomalies and threats using machine learning and behavioral models.	Included in license	Included in license	Included in license
  Automation	Orchestrates and automates security workflows with prebuilt and customizable playbooks.	Included in license	Included in license	Included in license
  Data Ingestion	Analytics tier: Collects and normalizes data, creating a unified foundation for analytics, investigation, and detection. GB/day-based, with a minimum of 100 GB/day. Cortex Data Lake tier: Provides cost-efficient ingestion and storage of security data at scale for use cases such as threat hunting, forensic investigations, and compliance audits. This tier is available as an optional add-on with a minimum of 50 GB/day, provided the mandatory 100 GB/day Analytics tier license is already met. For more information, see Configure Cortex Data Lake tier.	Included in license	Included in license	Included in license
  Enterprise Runtime Security (XDR)	Comprehensive endpoint and server protection by combining AI-driven analytics, endpoint controls, next-generation antivirus, and automated investigation to detect and respond to threats across various environments.	Add-on	Included in license	Included in license
  Cloud Posture Security	Agentless comprehensive visibility across your cloud environment. Includes: Up to 400 workloads, dependent on the license plan Cloud Security Posture Management (CSPM) Cloud Infrastructure Entitlement Management (CIEM) Data Security Posture Management (DSPM) AI Security Posture Management (AI-SPM) Continuous Integration/Continuous Deployment (CI/CD) Note For Cortex XSIAM Enterprise and NG SIEM, if purchasing Cloud Posture Security only, a minimum number of workloads is required. If you purchase Cloud Runtime Security or Cortex XSIAM Premium, this add-on is included with the subscription.	Add-on	Add-on	Included with Cloud Runtime Security
  Cloud Runtime Security	Full cloud protection, detection, and response. In addition to Cloud Posture Security: For Cortex XSIAM Premium: Minimum 200 workloads (priced per workload). Cloud Detection and Response (CDR) Cloud Workload Protection (CWP) Web Application and API Security (WAAS) Note For all Cortex XSIAM license plans, a minimum number of workloads is required.	Add-on (priced per cloud workload)	Add-on (priced per cloud workload)	Included capability (priced per cloud workload)
  Application Security	Comprehensive protection for your software development lifecycle (SDLC) from code-to-cloud, offering visibility, detection, contextual analysis, prioritization, prevention, and remediation. License requirements To access the Application Security module, you must have a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license. The following features are automatically included with these licenses: Application Security Posture Management (ASPM) CI/CD Security Add-on component: Code Security Code Security requires the purchase of a separate Application Security add-on in addition to your Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.	Add-on	Add-on	Add-on
  Extended Threat Intelligence (XTI)	Provides operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform	Add-on	Add-on	Included in license
  Threat Intelligence Management	Investigates indicators and files, uses indicator rules, reports, and feed integrations.	Add-on	Add-on	Included in license
  Attack Surface Management	Provides internet-facing assets and ASM enrichment, external services, external IP ranges, attack surface rules and alerts, ASM widgets, and report capabilities.	Add-on	Add-on	Included in license
  Identity Threat Detection & Response	Enables asset role configuration, advanced analytics alert layout, Risk Management dashboard, User/Host Risk view, designated analytics for compromised accounts, and insider threat coverage. This solution helps organizations proactively secure identities, accelerate threat response, and reduce the complexity of security operations.	Add-on	Add-on	Add-on
  Forensics	Detect attacker activity by reviewing key artifacts such as event logs, registry keys, browser history, etc. Forensics simplifies investigations so you can trace every move an adversary made and swiftly contain threats from one place without needing to pivot between security tools.	Add-on	Add-on	Add-on
  Host Insights	Host Insights combines Vulnerability Management, Host Inventory, and a powerful Search and Destroy feature to help you identify and contain threats. It offers a holistic approach to endpoint visibility and attack containment, helping reduce your exposure to threats so you can avoid future breaches.	Add-on	Included in license	Included in license
  Extended Threat Hunting	Investigates everyday activities in real time and analyzes patterns to discover new threats, aiming to proactively minimize risk for an organization.	Add-on	Included in license	Included in license
  Data Retention	Retention per dataset ensures extended access to data, strengthening threat investigation, compliance, and long-term visibility.	Add-on	Add-on	Add-on
  Extended Compute Units	Additional computing resources beyond the annual allocation. You can purchase more units or enable dynamic allocation for flexible access. This ensures uninterrupted service, supports scaling during peak workloads, and optimizes resource management to maintain performance during high-demand periods.	Add-on	Add-on	Add-on
  Endpoint Event Forwarding	Enables exporting the raw telemetry collected by XDR Agents and event data from cloud endpoints to external systems (if relevant).	Add-on	Add-on	Add-on
  GB Event Forwarding	Enables exporting parsed logs to an external SIEM for storage, so you can keep data in your own storage in addition to the Cortex XSIAMdata layer, for compliance requirements and machine learning purposes.	Add-on	Add-on	Add-on
  Advanced Email Security	Investigate and respond to threats within modern, distributed email infrastructures. The module is a scalable, API-based solution that passively analyzes cloud-hosted email environments to detect threats. It ingests data from messages, attachments, and user identities to identify early-stage threats and high-risk behaviors without requiring any changes to mail flow.	Add-on	Add-on	Add-on
  Exposure Management	Gain comprehensive visibility, actionable prioritization, and automation-first remediation to help security teams proactively assess and respond to organizational exposures.	Add-on	Add-on	Add-on
  DLP (Data Loss Prevention)	The Cortex Data Loss Prevention (DLP) module provides a unified and flexible solution to prevent sensitive data exfiltration. It continuously enforces policies on endpoints (even offline) across web, local, and USB channels, protecting both on-premise and cloud environments.	Add-on	Add-on	Add-on

  Feature	Description	Cortex XSIAM NG SIEM	Cortex XSIAM Enterprise	Cortex XSIAM Premium
  Core Analytics	Detects anomalies and threats using machine learning and behavioral models.	Included in license	Included in license	Included in license
  Automation	Orchestrates and automates security workflows with prebuilt and customizable playbooks.	Included in license	Included in license	Included in license
  Data Ingestion	Analytics tier: Collects and normalizes data, creating a unified foundation for analytics, investigation, and detection. GB/day-based, with a minimum of 100 GB/day. Cortex Data Lake tier: Provides cost-efficient ingestion and storage of security data at scale for use cases such as threat hunting, forensic investigations, and compliance audits. This tier is available as an optional add-on with a minimum of 50 GB/day, provided the mandatory 100 GB/day Analytics tier license is already met. For more information, see Configure Cortex Data Lake tier.	Included in license	Included in license	Included in license
  Enterprise Runtime Security (XDR)	Comprehensive endpoint and server protection by combining AI-driven analytics, endpoint controls, next-generation antivirus, and automated investigation to detect and respond to threats across various environments.	Add-on	Included in license	Included in license
  Cloud Posture Security	Agentless comprehensive visibility across your cloud environment. Includes: Up to 400 workloads, dependent on the license plan Cloud Security Posture Management (CSPM) Cloud Infrastructure Entitlement Management (CIEM) Data Security Posture Management (DSPM) AI Security Posture Management (AI-SPM) Continuous Integration/Continuous Deployment (CI/CD) Note For Cortex XSIAM Enterprise and NG SIEM, if purchasing Cloud Posture Security only, a minimum number of workloads is required. If you purchase Cloud Runtime Security or Cortex XSIAM Premium, this add-on is included with the subscription.	Add-on	Add-on	Included with Cloud Runtime Security
  Cloud Runtime Security	Full cloud protection, detection, and response. In addition to Cloud Posture Security: For Cortex XSIAM Premium: Minimum 200 workloads (priced per workload). Cloud Detection and Response (CDR) Cloud Workload Protection (CWP) Web Application and API Security (WAAS) Note For all Cortex XSIAM license plans, a minimum number of workloads is required.	Add-on	Add-on	Included in license
  Application Security	Comprehensive protection for your software development lifecycle (SDLC) from code-to-cloud, offering visibility, detection, contextual analysis, prioritization, prevention, and remediation. To access the Application Security module, you must have a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license. These licenses include Application Security Posture Management (ASPM) and CI/CD Security. Add-on component: Code Security Code Security requires a separate Application Security add-on as well as a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.	Add-on	Add-on	Add-on
  Extended Threat Intelligence (XTI)	Provides operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform	Add-on	Add-on	Included in license
  Threat Intelligence Management	Investigates indicators and files, uses indicator rules, reports, and feed integrations.	Add-on	Add-on	Included in license
  Attack Surface Management	Provides internet-facing assets and ASM enrichment, external services, external IP ranges, attack surface rules and alerts, ASM widgets, and report capabilities.	Add-on	Add-on	Included in license
  Identity Threat Detection & Response	Enables asset role configuration, advanced analytics alert layout, Risk Management dashboard, User/Host Risk view, designated analytics for compromised accounts, and insider threat coverage. This solution helps organizations proactively secure identities, accelerate threat response, and reduce the complexity of security operations.	Add-on	Add-on	Add-on
  Forensics	Detect attacker activity by reviewing key artifacts such as event logs, registry keys, browser history, etc. Forensics simplifies investigations so you can trace every move an adversary made and swiftly contain threats from one place without needing to pivot between security tools.	Add-on	Add-on	Add-on
  Host Insights	Host Insights combines Vulnerability Management, Host Inventory, and a powerful Search and Destroy feature to help you identify and contain threats. It offers a holistic approach to endpoint visibility and attack containment, helping reduce your exposure to threats so you can avoid future breaches.	Add-on	Included in license	Included in license
  Extended Threat Hunting	Investigates everyday activities in real time and analyzes patterns to discover new threats, aiming to proactively minimize risk for an organization.	Add-on	Included in license	Included in license
  Data Retention	Retention per dataset ensures extended access to data, strengthening threat investigation, compliance, and long-term visibility.	Add-on	Add-on	Add-on
  Extended Compute Units	Additional computing resources beyond the annual allocation. You can purchase more units or enable dynamic allocation for flexible access. This ensures uninterrupted service, supports scaling during peak workloads, and optimizes resource management to maintain performance during high-demand periods.	Add-on	Add-on	Add-on
  Endpoint Event Forwarding	Enables exporting the raw telemetry collected by XDR Agents and event data from cloud endpoints to external systems (if relevant).	Add-on	Add-on	Add-on
  GB Event Forwarding	Enables exporting parsed logs to an external SIEM for storage, so you can keep data in your own storage in addition to the Cortex XSIAMdata layer, for compliance requirements and machine learning purposes.	Add-on	Add-on	Add-on
  Advanced Email Security	Investigate and respond to threats within modern, distributed email infrastructures. The module is a scalable, API-based solution that passively analyzes cloud-hosted email environments to detect threats. It ingests data from messages, attachments, and user identities to identify early-stage threats and high-risk behaviors without requiring any changes to mail flow.	Add-on	Add-on	Add-on
  Exposure Management	Gain comprehensive visibility, actionable prioritization, and automation-first remediation to help security teams proactively assess and respond to organizational exposures.	Add-on	Add-on	Add-on
  DLP (Data Loss Prevention)	The Cortex Data Loss Prevention (DLP) module provides a unified and flexible solution to prevent sensitive data exfiltration. It continuously enforces policies on endpoints (even offline) across web, local, and USB channels, protecting both on-premise and cloud environments.	Add-on	Add-on	Add-on

  endtab

  endtab

  tab Tiers and key capabilities

  tab Tiers and key capabilities

  🖼 Cortex_XSIAM_Licenses_Jan22.png

  🖼 Cortex_XSIAM_Licenses_Jan22.png

  endtab

  endtab

  endtabs

  endtabs

  Show markdown source

  @@ -46,15 +46,15 @@ Existing users who have a Cortex XSIAM Enterprise Plus license retain all Cortex
   
   Some add-ons, such as Advanced Email Security and Exposure Management, are only available for Cortex XSIAM Premium, Enterprise, and NG-SIEM licenses.
   {% endhint %}
   
   {% tabs %}
   {% tab title="Capabilities and add-ons" %}
   Cortex offers a modular set of license packages that work interchangeably with each other, allowing them to become add-ons to subsequent products seamlessly. The table below shows the breakdown of each type of license package:
   
  -<table><thead><tr><th width="114.5">Feature</th><th width="220.5">Description</th><th width="117.5" align="center">Cortex XSIAM NG SIEM</th><th width="120.5" align="center">Cortex XSIAM Enterprise</th><th align="center">Cortex XSIAM Premium</th></tr></thead><tbody><tr><td>Core Analytics</td><td>Detects anomalies and threats using machine learning and behavioral models.</td><td align="center">Included in license</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Automation</td><td>Orchestrates and automates security workflows with prebuilt and customizable playbooks.</td><td align="center">Included in license</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Data Ingestion</td><td><p><strong>Analytics tier</strong>: Collects and normalizes data, creating a unified foundation for analytics, investigation, and detection. GB/day-based, with a minimum of 100 GB/day.<br></p><p><strong>Cortex Data Lake tier</strong>: Provides cost-efficient ingestion and storage of security data at scale for use cases such as threat hunting, forensic investigations, and compliance audits. This tier is available as an optional add-on with a minimum of 50 GB/day, provided the mandatory 100 GB/day Analytics tier license is already met. For more information, see <a href="../configure-cortex-xsiam/data-management/configure-cortex-data-lake-tier">Configure Cortex Data Lake tier</a>.</p></td><td align="center">Included in license</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Enterprise Runtime Security (XDR)</td><td>Comprehensive endpoint and server protection by combining AI-driven analytics, endpoint controls, next-generation antivirus, and automated investigation to detect and respond to threats across various environments.</td><td align="center">Add-on</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Cloud Posture Security</td><td><p>Agentless comprehensive visibility across your cloud environment. Includes:</p><ul><li>Up to 400 workloads, dependent on the license plan</li><li>Cloud Security Posture Management (CSPM)</li><li>Cloud Infrastructure Entitlement Management (CIEM)</li><li>Data Security Posture Management (DSPM)</li><li>AI Security Posture Management (AI-SPM)</li><li>Continuous Integration/Continuous Deployment (CI/CD)</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>For Cortex XSIAM Enterprise and NG SIEM, if purchasing Cloud Posture Security only, a minimum number of workloads is required. If you purchase Cloud Runtime Security or Cortex XSIAM Premium, this add-on is included with the subscription.</p></div></td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Included with Cloud Runtime Security</td></tr><tr><td>Cloud Runtime Security</td><td><p>Full cloud protection, detection, and response. In addition to Cloud Posture Security:</p><ul><li>For Cortex XSIAM Premium: Minimum 200 workloads (priced per workload).</li><li>Cloud Detection and Response (CDR)</li><li>Cloud Workload Protection (CWP)</li><li>Web Application and API Security (WAAS)</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>For all Cortex XSIAM license plans, a minimum number of workloads is required.</p></div></td><td align="center">Add-on (priced per cloud workload)</td><td align="center">Add-on (priced per cloud workload)</td><td align="center">Included capability (priced per cloud workload)</td></tr><tr><td>Application Security</td><td><p>Comprehensive protection for your software development lifecycle (SDLC) from code-to-cloud, offering visibility, detection, contextual analysis, prioritization, prevention, and remediation.</p><p><strong>License requirements</strong></p><p>To access the Application Security module, you must have a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license. The following features are automatically included with these licenses:</p><ul><li>Application Security Posture Management (ASPM)</li><li>CI/CD Security</li></ul><p><strong>Add-on component: Code Security</strong></p><p>Code Security requires the purchase of a separate Application Security add-on in addition to your Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.</p></td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Extended Threat Intelligence (XTI)</td><td>Provides operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Included in license</td></tr><tr><td>Threat Intelligence Management</td><td>Investigates indicators and files, uses indicator rules, reports, and feed integrations.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Included in license</td></tr><tr><td>Attack Surface Management</td><td>Provides internet-facing assets and ASM enrichment, external services, external IP ranges, attack surface rules and alerts, ASM widgets, and report capabilities.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Included in license</td></tr><tr><td>Identity Threat Detection &#x26; Response</td><td>Enables asset role configuration, advanced analytics alert layout, Risk Management dashboard, User/Host Risk view, designated analytics for compromised accounts, and insider threat coverage. This solution helps organizations proactively secure identities, accelerate threat response, and reduce the complexity of security operations.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Forensics</td><td>Detect attacker activity by reviewing key artifacts such as event logs, registry keys, browser history, etc. Forensics simplifies investigations so you can trace every move an adversary made and swiftly contain threats from one place without needing to pivot between security tools.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Host Insights</td><td>Host Insights combines Vulnerability Management, Host Inventory, and a powerful Search and Destroy feature to help you identify and contain threats. It offers a holistic approach to endpoint visibility and attack containment, helping reduce your exposure to threats so you can avoid future breaches.</td><td align="center">Add-on</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Extended Threat Hunting</td><td>Investigates everyday activities in real time and analyzes patterns to discover new threats, aiming to proactively minimize risk for an organization.</td><td align="center">Add-on</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Data Retention</td><td>Retention per dataset ensures extended access to data, strengthening threat investigation, compliance, and long-term visibility.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Extended Compute Units</td><td>Additional computing resources beyond the annual allocation. You can purchase more units or enable dynamic allocation for flexible access. This ensures uninterrupted service, supports scaling during peak workloads, and optimizes resource management to maintain performance during high-demand periods.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Endpoint Event Forwarding</td><td>Enables exporting the raw telemetry collected by XDR Agents and event data from cloud endpoints to external systems (if relevant).</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>GB Event Forwarding</td><td>Enables exporting parsed logs to an external SIEM for storage, so you can keep data in your own storage in addition to the Cortex XSIAMdata layer, for compliance requirements and machine learning purposes.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Advanced Email Security</td><td>Investigate and respond to threats within modern, distributed email infrastructures. The module is a scalable, API-based solution that passively analyzes cloud-hosted email environments to detect threats. It ingests data from messages, attachments, and user identities to identify early-stage threats and high-risk behaviors without requiring any changes to mail flow.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Exposure Management</td><td>Gain comprehensive visibility, actionable prioritization, and automation-first remediation to help security teams proactively assess and respond to organizational exposures.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>DLP (Data Loss Prevention)</td><td>The Cortex Data Loss Prevention (DLP) module provides a unified and flexible solution to prevent sensitive data exfiltration. It continuously enforces policies on endpoints (even offline) across web, local, and USB channels, protecting both on-premise and cloud environments.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr></tbody></table>
  +<table><thead><tr><th width="114.5">Feature</th><th width="220.5">Description</th><th width="117.5" align="center">Cortex XSIAM NG SIEM</th><th width="120.5" align="center">Cortex XSIAM Enterprise</th><th align="center">Cortex XSIAM Premium</th></tr></thead><tbody><tr><td>Core Analytics</td><td>Detects anomalies and threats using machine learning and behavioral models.</td><td align="center">Included in license</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Automation</td><td>Orchestrates and automates security workflows with prebuilt and customizable playbooks.</td><td align="center">Included in license</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Data Ingestion</td><td><p><strong>Analytics tier</strong>: Collects and normalizes data, creating a unified foundation for analytics, investigation, and detection. GB/day-based, with a minimum of 100 GB/day.<br></p><p><strong>Cortex Data Lake tier</strong>: Provides cost-efficient ingestion and storage of security data at scale for use cases such as threat hunting, forensic investigations, and compliance audits. This tier is available as an optional add-on with a minimum of 50 GB/day, provided the mandatory 100 GB/day Analytics tier license is already met. For more information, see <a href="../configure-cortex-xsiam/data-management/configure-cortex-data-lake-tier">Configure Cortex Data Lake tier</a>.</p></td><td align="center">Included in license</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Enterprise Runtime Security (XDR)</td><td>Comprehensive endpoint and server protection by combining AI-driven analytics, endpoint controls, next-generation antivirus, and automated investigation to detect and respond to threats across various environments.</td><td align="center">Add-on</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Cloud Posture Security</td><td><p>Agentless comprehensive visibility across your cloud environment. Includes:</p><ul><li>Up to 400 workloads, dependent on the license plan</li><li>Cloud Security Posture Management (CSPM)</li><li>Cloud Infrastructure Entitlement Management (CIEM)</li><li>Data Security Posture Management (DSPM)</li><li>AI Security Posture Management (AI-SPM)</li><li>Continuous Integration/Continuous Deployment (CI/CD)</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>For Cortex XSIAM Enterprise and NG SIEM, if purchasing Cloud Posture Security only, a minimum number of workloads is required. If you purchase Cloud Runtime Security or Cortex XSIAM Premium, this add-on is included with the subscription.</p></div></td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Included with Cloud Runtime Security</td></tr><tr><td>Cloud Runtime Security</td><td><p>Full cloud protection, detection, and response. In addition to Cloud Posture Security:</p><ul><li>For Cortex XSIAM Premium: Minimum 200 workloads (priced per workload).</li><li>Cloud Detection and Response (CDR)</li><li>Cloud Workload Protection (CWP)</li><li>Web Application and API Security (WAAS)</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>For all Cortex XSIAM license plans, a minimum number of workloads is required.</p></div></td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Included in license</td></tr><tr><td>Application Security</td><td><p>Comprehensive protection for your software development lifecycle (SDLC) from code-to-cloud, offering visibility, detection, contextual analysis, prioritization, prevention, and remediation.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>To access the Application Security module, you must have a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license. These licenses include Application Security Posture Management (ASPM) and CI/CD Security.</p><p></p></div><p><strong>Add-on component: Code Security</strong></p><p>Code Security requires a separate Application Security add-on as well as a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.</p></td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Extended Threat Intelligence (XTI)</td><td>Provides operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Included in license</td></tr><tr><td>Threat Intelligence Management</td><td>Investigates indicators and files, uses indicator rules, reports, and feed integrations.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Included in license</td></tr><tr><td>Attack Surface Management</td><td>Provides internet-facing assets and ASM enrichment, external services, external IP ranges, attack surface rules and alerts, ASM widgets, and report capabilities.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Included in license</td></tr><tr><td>Identity Threat Detection &#x26; Response</td><td>Enables asset role configuration, advanced analytics alert layout, Risk Management dashboard, User/Host Risk view, designated analytics for compromised accounts, and insider threat coverage. This solution helps organizations proactively secure identities, accelerate threat response, and reduce the complexity of security operations.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Forensics</td><td>Detect attacker activity by reviewing key artifacts such as event logs, registry keys, browser history, etc. Forensics simplifies investigations so you can trace every move an adversary made and swiftly contain threats from one place without needing to pivot between security tools.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Host Insights</td><td>Host Insights combines Vulnerability Management, Host Inventory, and a powerful Search and Destroy feature to help you identify and contain threats. It offers a holistic approach to endpoint visibility and attack containment, helping reduce your exposure to threats so you can avoid future breaches.</td><td align="center">Add-on</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Extended Threat Hunting</td><td>Investigates everyday activities in real time and analyzes patterns to discover new threats, aiming to proactively minimize risk for an organization.</td><td align="center">Add-on</td><td align="center">Included in license</td><td align="center">Included in license</td></tr><tr><td>Data Retention</td><td>Retention per dataset ensures extended access to data, strengthening threat investigation, compliance, and long-term visibility.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Extended Compute Units</td><td>Additional computing resources beyond the annual allocation. You can purchase more units or enable dynamic allocation for flexible access. This ensures uninterrupted service, supports scaling during peak workloads, and optimizes resource management to maintain performance during high-demand periods.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Endpoint Event Forwarding</td><td>Enables exporting the raw telemetry collected by XDR Agents and event data from cloud endpoints to external systems (if relevant).</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>GB Event Forwarding</td><td>Enables exporting parsed logs to an external SIEM for storage, so you can keep data in your own storage in addition to the Cortex XSIAMdata layer, for compliance requirements and machine learning purposes.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Advanced Email Security</td><td>Investigate and respond to threats within modern, distributed email infrastructures. The module is a scalable, API-based solution that passively analyzes cloud-hosted email environments to detect threats. It ingests data from messages, attachments, and user identities to identify early-stage threats and high-risk behaviors without requiring any changes to mail flow.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>Exposure Management</td><td>Gain comprehensive visibility, actionable prioritization, and automation-first remediation to help security teams proactively assess and respond to organizational exposures.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr><tr><td>DLP (Data Loss Prevention)</td><td>The Cortex Data Loss Prevention (DLP) module provides a unified and flexible solution to prevent sensitive data exfiltration. It continuously enforces policies on endpoints (even offline) across web, local, and USB channels, protecting both on-premise and cloud environments.</td><td align="center">Add-on</td><td align="center">Add-on</td><td align="center">Add-on</td></tr></tbody></table>
   {% endtab %}
   
   {% tab title="Tiers and key capabilities" %}
   ![Cortex\_XSIAM\_Licenses\_Jan22.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2Fgit-blob-6fdb607b274648cb3f73a7e0e9f6cfe4032a1cd2%2F5b62c9bed0f82de84c5275ad1e207744fac8d8a39f773e8afef87071312e2799.png?alt=media)
   {% endtab %}
   {% endtabs %}
  

• ▸ ▾ Navigate the Cortex XSIAM docs modified +12 −10 xsiam/learn-about-cortex-xsiam/readme

  Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

  Before After

  @@ -4,38 +4,40 @@ description: Start here for a visual overview of the main Cortex XSIAM documenta

  # Navigate the Cortex XSIAM docs

  # Navigate the Cortex XSIAM docs

  Cortex XSIAM unifies detection, investigation, response, endpoint security, and cloud security in one platform.

  Cortex XSIAM unifies detection, investigation, response, endpoint security, and cloud security in one platform.

  Use this page to jump into the right docs area fast.

  Use this page to jump into the right docs area fast.

  hint info

  hint info

  Use the table of contents when you know the exact page. Use this page when you want a fast overview of the full Cortex XSIAM docs set.

  Use the table of contents when you know the exact page.

  Use this page when you need a quick overview of the main Cortex XSIAM areas.

  endhint

  endhint

  ### Learn about Cortex XSIAM

  ### Learn the product

  :wand-magic-sparkles: Agentic AI in Cortex XSIAM Explore AI-powered investigation, response, and workflows.	agentic-ai-in-cortex-xsiam
  :id-card: Cortex XSIAM product licenses Understand licensing options and feature entitlements.	cortex-xsiam-product-licenses
  :key: Manage API keys Create and manage keys for API access.	manage-api-keys

  :circle-info: Product overview Learn about the basics and architecture.	get-started-cortex-xsiam
  :wand-magic-sparkles: Agentic AI Explore AI-powered investigation, response, and workflows.	agentic-ai-in-cortex-xsiam
  :id-card: Licensing Review plans, add-ons, and retention.	cortex-xsiam-product-licenses
  :desktop: Interface Navigate pages, filters, views, and exports.	use-the-interface

  ### Set up Cortex XSIAM

  ### Onboard Cortex XSIAM

  :list-check: Plan and prepare Consider storage, region, XDR agent, and data sources requirements.	plan-and-prepare
  :gears: Deployment steps Set up your tenant, XDR Agent, users, and analytics.	deployment-steps
  :check-double: Post-deployment Validate your deployment and complete initial tasks.	post-deployment
  :plug: Cortex XSIAM Data Sources Connect supported data sources to Cortex XSIAM.	cortex-xsiam-data-sources

  :list-check: Plan and prepare Consider storage, region, XDR agent, and data sources requirements.	plan-and-prepare
  :clipboard-list: Deployment checklist Follow the key steps to deploy and onboard.	cortex-xsiam-onboarding-checklist
  :check-double: Post-deployment Validate your deployment and complete initial tasks.	post-deployment
  :plug: Cortex XSIAM Data Sources Connect data sources, including CSP, and Cloud Posture and Runtime Security data sources.	cortex-xsiam-data-sources
  :chart-line: Analytics Set up analytics and enable the analytics engine.	cortex-xsiam-analytics

  ### Configure Cortex XSIAM

  ### Configure Cortex XSIAM

  :database: Data management Manage ingestion, retention, and data access.	data-management
  :store: Marketplace Discover and install integrations and content packs.	marketplace
  :robot: Configure the Cortex Agentic Assistant Set up assistant access and capabilities.	configure-the-cortex-agentic-assistant-1
  :server: Cortex MCP server Connect external AI clients through the MCP server.	cortex-mcp-server
  :bolt: Automations Automate recurring security tasks and responses.	automations
  :gear: Engines Configure detection and automation processing engines.	engines
  :code-branch: Remote repository management Connect repositories for version-controlled content.	remote-repository-management
  :folder-tree: Customize cases and issues Tailor case and issue workflows to your needs.	customize-cases-and-issues
  :building: Multi-Tenant Manage tenants and their security operations.	multi-tenant
  :handshake: Managed Services configuration in Cortex Configure services for managed security operations.	managed-services-configuration-in-cortex

  :database: Data management Manage ingestion, retention, and data access.	data-management
  :robot: Configure the Cortex Agentic Assistant Set up assistant access and capabilities.	configure-the-cortex-agentic-assistant-1
  :server: Cortex MCP server Connect external AI clients through the MCP server.	cortex-mcp-server
  :bolt: Automations Automate recurring security tasks and responses.	automations
  :folder-tree: Customize cases and issues Tailor case and issue workflows to your needs.	customize-cases-and-issues
  :building: Multi-Tenant Manage tenants and their security operations.	multi-tenant
  :handshake: Managed Services configuration in Cortex Configure services for managed security operations.	managed-services-configuration-in-cortex

  ### Protect your endpoints

  ### Protect your environment

  :shield-halved: Endpoint security Prevent, detect, and respond to endpoint threats.	endpoint-security
  :lock: Endpoint DLP Protect sensitive data on managed endpoints.	endpoint-dlp

  :shield-halved: Endpoint security Prevent, detect, and respond to endpoint threats.	endpoint-security
  :lock: Endpoint DLP Protect sensitive data on managed endpoints.	endpoint-dlp

  ### Detect, investigate, and respond to threats

  ### Detect, investigate, and respond

  :chart-line: Monitor dashboards and reports Track security operations with dashboards and reports.	monitor-dashboards-and-reports
  :magnifying-glass: Investigation and response Investigate cases/issues and respond to threats.	investigation-and-response
  :comments: Agentic Assistant chat Use natural language to investigate security data.	agentic-assistant-chat
  :boxes-stacked: Asset management Inventory and monitor assets across your environment.	asset-management
  :crosshairs: Threat management Prioritize and manage threats affecting your organization.	threat-management
  :globe: Attack Surface Management Discover and assess internet-facing attack surface risks.	attack-surface-management
  :bug: Vulnerability management Identify, prioritize, and remediate vulnerabilities.	vulnerability-management
  :radar: Exposure management Understand and reduce your overall cyber exposure.	exposure-management

  :chart-line: Monitor dashboards and reports Track security operations, trends, and outcomes.	monitor-dashboards-and-reports
  :magnifying-glass: Investigation and response Investigate cases/issues and respond to threats.	investigation-and-response
  :comments: Agentic Assistant chat Use natural language to investigate security data.	agentic-assistant-chat
  :boxes-stacked: Asset management Inventory and monitor assets across your environment.	asset-management
  :crosshairs: Threats Prioritize and manage threats affecting your organization.	threat-management
  :globe: Attack Surface Management Discover and assess internet-facing attack surface risks.	attack-surface-management
  :bug: Vulnerability management Identify, prioritize, and remediate vulnerabilities.	vulnerability-management
  :radar: Exposure management Understand and reduce your overall cyber exposure.	exposure-management

  ### Cloud Security

  ### Cloud Security

  :database: Data Security Discover and protect sensitive cloud data.	cortex-data-security
  :scale-balanced: Monitor and track compliance adherence Measure cloud compliance against supported standards.	monitor-and-track-compliance-adherence
  :shield: Cloud Security Rules and Policies Configure policies and rules for cloud protection.	cloud-security-rules-and-policies
  :tags: Cloud Data Classification Classify cloud data using sensitive data profiles.	cortex-cloud-data-classification
  :user-shield: Cloud Identity Security Secure cloud identities and their permissions.	cortex-cloud-identity-security
  :network-wired: Network exposure detection Identify cloud network paths that create exposure.	network-exposure-detection
  :brain: Cloud AI Security Secure AI services and workloads in the cloud.	cortex-cloud-ai-security
  :bolt: Serverless function posture security Assess configuration risks in serverless functions.	serverless-function-posture-security
  :code: Cloud Application Security Protect cloud-native applications across their lifecycle.	cortex-cloud-application-security
  :cloud: Cloud workload policies and rules Define controls for cloud workloads and resources.	cloud-workload-policies-and-rules
  :globe: Web and API Security (WAAS) Protect web applications and APIs from attacks.	overview
  :play: Serverless function runtime security Detect runtime threats in serverless functions.	overview-1
  :envelope-open-text: Cortex Advanced Email Security Protect users from email-based threats.	cortex-advanced-email-security

  :database: Data Security Discover and protect sensitive cloud data.	cortex-data-security
  :scale-balanced: Monitor and track compliance adherence Measure cloud compliance against supported standards.	monitor-and-track-compliance-adherence
  :shield: Cloud Security Rules and Policies Configure policies and rules for cloud protection.	cloud-security-rules-and-policies
  :tags: Cloud Data Classification Classify cloud data using sensitive data profiles.	cortex-cloud-data-classification
  :user-shield: Cloud Identity Security Secure cloud identities and their permissions.	cortex-cloud-identity-security
  :network-wired: Network exposure detection Identify cloud network paths that create exposure.	network-exposure-detection
  :brain: Cloud AI Security Secure AI services and workloads in the cloud.	cortex-cloud-ai-security
  :bolt: Serverless function posture security Assess configuration risks in serverless functions.	serverless-function-posture-security
  :code: Cloud Application Security Protect cloud-native applications across their lifecycle.	cortex-cloud-application-security
  :cloud: Cloud workload policies and rules Define controls for cloud workloads and resources.	cloud-workload-policies-and-rules
  :globe: Web and API Security (WAAS) Protect web applications and APIs from attacks.	overview
  :play: Serverless function runtime security Detect runtime threats in serverless functions.	overview-1
  :envelope-open-text: Cortex Advanced Email Security Protect users from email-based threats.	cortex-advanced-email-security

  ### Reference and developer docs

  ### Reference and developer docs

  :terminal: Cortex XSIAM XQL Query and analyze security data with XQL.	cortex-agentix-xql
  :share-nodes: Graph Search Explore relationships between entities and events.	graph-search
  :terminal: Cortex CLI Manage Cortex XSIAM from the command line.	about-cortex-cli
  :user-lock: Role-Based Access Control Control access with roles and permissions.	role-based-access-control
  :code: API documentation Integrate Cortex XSIAM with its public APIs.	api-documentation
  :book-open: Reference Find detailed product and configuration reference material.	reference

  :terminal: XQL Query and analyze security data with XQL.	cortex-agentix-xql
  :share-nodes: Graph Search Explore relationships between entities and events.	graph-search
  :terminal: Cortex CLI Manage Cortex XSIAM from the command line.	about-cortex-cli
  :user-lock: Role-Based Access Control Control access with roles and permissions.	role-based-access-control
  :code: API documentation Integrate Cortex XSIAM with its public APIs.	api-documentation

  Show markdown source

  @@ -4,38 +4,40 @@ description: Start here for a visual overview of the main Cortex XSIAM documenta
   
   # Navigate the Cortex XSIAM docs
   
   Cortex XSIAM unifies detection, investigation, response, endpoint security, and cloud security in one platform.
   
   Use this page to jump into the right docs area fast.
   
   {% hint style="info" %}
  -Use the table of contents when you know the exact page. Use this page when you want a fast overview of the full Cortex XSIAM docs set.
  +Use the table of contents when you know the exact page.
  +
  +Use this page when you need a quick overview of the main Cortex XSIAM areas.
   {% endhint %}
   
  -### Learn about Cortex XSIAM
  +### Learn the product
   
  -<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-wand-magic-sparkles">:wand-magic-sparkles:</i> Agentic AI in Cortex XSIAM</p><p>Explore AI-powered investigation, response, and workflows.</p></td><td><a href="agentic-ai-in-cortex-xsiam">agentic-ai-in-cortex-xsiam</a></td></tr><tr><td><p><i class="fa-id-card">:id-card:</i> Cortex XSIAM product licenses</p><p>Understand licensing options and feature entitlements.</p></td><td><a href="cortex-xsiam-product-licenses">cortex-xsiam-product-licenses</a></td></tr><tr><td><p><i class="fa-key">:key:</i> Manage API keys</p><p>Create and manage keys for API access.</p></td><td><a href="manage-api-keys">manage-api-keys</a></td></tr></tbody></table>
  +<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-circle-info">:circle-info:</i> Product overview</p><p>Learn about the basics and architecture.</p></td><td><a href="get-started-cortex-xsiam">get-started-cortex-xsiam</a></td></tr><tr><td><p><i class="fa-wand-magic-sparkles">:wand-magic-sparkles:</i> Agentic AI</p><p>Explore AI-powered investigation, response, and workflows.</p></td><td><a href="agentic-ai-in-cortex-xsiam">agentic-ai-in-cortex-xsiam</a></td></tr><tr><td><p><i class="fa-id-card">:id-card:</i> Licensing</p><p>Review plans, add-ons, and retention.</p></td><td><a href="cortex-xsiam-product-licenses">cortex-xsiam-product-licenses</a></td></tr><tr><td><p><i class="fa-desktop">:desktop:</i> Interface</p><p>Navigate pages, filters, views, and exports.</p></td><td><a href="use-the-interface">use-the-interface</a></td></tr></tbody></table>
   
  -### Set up Cortex XSIAM
  +### Onboard Cortex XSIAM
   
  -<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-list-check">:list-check:</i> Plan and prepare</p><p>Consider storage, region, XDR agent, and data sources requirements.</p></td><td><a href="../onboard-cortex-xsiam/plan-and-prepare">plan-and-prepare</a></td></tr><tr><td><p><i class="fa-gears">:gears:</i> Deployment steps</p><p>Set up your tenant, XDR Agent, users, and analytics. </p></td><td><a href="../onboard-cortex-xsiam/deployment-steps">deployment-steps</a></td></tr><tr><td><p><i class="fa-check-double">:check-double:</i> Post-deployment</p><p>Validate your deployment and complete initial tasks.</p></td><td><a href="../onboard-cortex-xsiam/post-deployment">post-deployment</a></td></tr><tr><td><p><i class="fa-plug">:plug:</i> Cortex XSIAM Data Sources</p><p>Connect supported data sources to Cortex XSIAM.</p></td><td><a href="../configure-cortex-xsiam/cortex-xsiam-data-sources">cortex-xsiam-data-sources</a></td></tr></tbody></table>
  +<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-list-check">:list-check:</i> Plan and prepare</p><p>Consider storage, region, XDR agent, and data sources requirements.</p></td><td><a href="../onboard-cortex-xsiam/plan-and-prepare">plan-and-prepare</a></td></tr><tr><td><p><i class="fa-clipboard-list">:clipboard-list:</i> Deployment checklist</p><p>Follow the key steps to deploy and onboard.</p></td><td><a href="../onboard-cortex-xsiam/deployment-steps/cortex-xsiam-onboarding-checklist">cortex-xsiam-onboarding-checklist</a></td></tr><tr><td><p><i class="fa-check-double">:check-double:</i> Post-deployment</p><p>Validate your deployment and complete initial tasks.</p></td><td><a href="../onboard-cortex-xsiam/post-deployment">post-deployment</a></td></tr><tr><td><p><i class="fa-plug">:plug:</i> Cortex XSIAM Data Sources</p><p>Connect data sources, including CSP, and Cloud Posture and Runtime Security data sources.</p></td><td><a href="../configure-cortex-xsiam/cortex-xsiam-data-sources">cortex-xsiam-data-sources</a></td></tr><tr><td><p><i class="fa-chart-line">:chart-line:</i> Analytics</p><p>Set up analytics and enable the analytics engine.</p></td><td><a href="../onboard-cortex-xsiam/deployment-steps/cortex-xsiam-analytics">cortex-xsiam-analytics</a></td></tr><tr><td></td><td></td></tr></tbody></table>
   
   ### Configure Cortex XSIAM
   
  -<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-database">:database:</i> Data management</p><p>Manage ingestion, retention, and data access.</p></td><td><a href="../configure-cortex-xsiam/data-management">data-management</a></td></tr><tr><td><p><i class="fa-store">:store:</i> Marketplace</p><p>Discover and install integrations and content packs.</p></td><td><a href="../configure-cortex-xsiam/marketplace">marketplace</a></td></tr><tr><td><p><i class="fa-robot">:robot:</i> Configure the Cortex Agentic Assistant</p><p>Set up assistant access and capabilities.</p></td><td><a href="../configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1">configure-the-cortex-agentic-assistant-1</a></td></tr><tr><td><p><i class="fa-server">:server:</i> Cortex MCP server</p><p>Connect external AI clients through the MCP server.</p></td><td><a href="../configure-cortex-xsiam/cortex-mcp-server">cortex-mcp-server</a></td></tr><tr><td><p><i class="fa-bolt">:bolt:</i> Automations</p><p>Automate recurring security tasks and responses.</p></td><td><a href="../configure-cortex-xsiam/automations">automations</a></td></tr><tr><td><p><i class="fa-gear">:gear:</i> Engines</p><p>Configure detection and automation processing engines.</p></td><td><a href="../configure-cortex-xsiam/engines">engines</a></td></tr><tr><td><p><i class="fa-code-branch">:code-branch:</i> Remote repository management</p><p>Connect repositories for version-controlled content.</p></td><td><a href="../configure-cortex-xsiam/remote-repository-management">remote-repository-management</a></td></tr><tr><td><p><i class="fa-folder-tree">:folder-tree:</i> Customize cases and issues</p><p>Tailor case and issue workflows to your needs.</p></td><td><a href="../configure-cortex-xsiam/customize-cases-and-issues">customize-cases-and-issues</a></td></tr><tr><td><p><i class="fa-building">:building:</i> Multi-Tenant</p><p>Manage tenants and their security operations.</p></td><td><a href="../configure-cortex-xsiam/multi-tenant">multi-tenant</a></td></tr><tr><td><p><i class="fa-handshake">:handshake:</i> Managed Services configuration in Cortex</p><p>Configure services for managed security operations.</p></td><td><a href="../configure-cortex-xsiam/managed-services-configuration-in-cortex">managed-services-configuration-in-cortex</a></td></tr></tbody></table>
  +<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-database">:database:</i> Data management</p><p>Manage ingestion, retention, and data access.</p></td><td><a href="../configure-cortex-xsiam/data-management">data-management</a></td></tr><tr><td><p><i class="fa-robot">:robot:</i> Configure the Cortex Agentic Assistant</p><p>Set up assistant access and capabilities.</p></td><td><a href="../configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1">configure-the-cortex-agentic-assistant-1</a></td></tr><tr><td><p><i class="fa-server">:server:</i> Cortex MCP server</p><p>Connect external AI clients through the MCP server.</p></td><td><a href="../configure-cortex-xsiam/cortex-mcp-server">cortex-mcp-server</a></td></tr><tr><td><p><i class="fa-bolt">:bolt:</i> Automations</p><p>Automate recurring security tasks and responses.</p></td><td><a href="../configure-cortex-xsiam/automations">automations</a></td></tr><tr><td><p><i class="fa-folder-tree">:folder-tree:</i> Customize cases and issues</p><p>Tailor case and issue workflows to your needs.</p></td><td><a href="../configure-cortex-xsiam/customize-cases-and-issues">customize-cases-and-issues</a></td></tr><tr><td><p><i class="fa-building">:building:</i> Multi-Tenant</p><p>Manage tenants and their security operations.</p></td><td><a href="../configure-cortex-xsiam/multi-tenant">multi-tenant</a></td></tr><tr><td><p><i class="fa-handshake">:handshake:</i> Managed Services configuration in Cortex</p><p>Configure services for managed security operations.</p></td><td><a href="../configure-cortex-xsiam/managed-services-configuration-in-cortex">managed-services-configuration-in-cortex</a></td></tr></tbody></table>
   
  -### Protect your endpoints
  +### Protect your environment
   
   <table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-shield-halved">:shield-halved:</i> Endpoint security</p><p>Prevent, detect, and respond to endpoint threats.</p></td><td><a href="../protect-your-endpoints/endpoint-security">endpoint-security</a></td></tr><tr><td><p><i class="fa-lock">:lock:</i> Endpoint DLP</p><p>Protect sensitive data on managed endpoints.</p></td><td><a href="../protect-your-endpoints/endpoint-dlp">endpoint-dlp</a></td></tr></tbody></table>
   
  -### Detect, investigate, and respond to threats
  +### Detect, investigate, and respond
   
  -<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-chart-line">:chart-line:</i> Monitor dashboards and reports</p><p>Track security operations with dashboards and reports.</p></td><td><a href="../detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports">monitor-dashboards-and-reports</a></td></tr><tr><td><p><i class="fa-magnifying-glass">:magnifying-glass:</i> Investigation and response</p><p>Investigate cases/issues and respond to threats.</p></td><td><a href="../detect-investigate-and-respond-to-threats/investigation-and-response">investigation-and-response</a></td></tr><tr><td><p><i class="fa-comments">:comments:</i> Agentic Assistant chat</p><p>Use natural language to investigate security data.</p></td><td><a href="../detect-investigate-and-respond-to-threats/agentic-assistant-chat">agentic-assistant-chat</a></td></tr><tr><td><p><i class="fa-boxes-stacked">:boxes-stacked:</i> Asset management</p><p>Inventory and monitor assets across your environment.</p></td><td><a href="../detect-investigate-and-respond-to-threats/asset-management">asset-management</a></td></tr><tr><td><p><i class="fa-crosshairs">:crosshairs:</i> Threat management</p><p>Prioritize and manage threats affecting your organization.</p></td><td><a href="../detect-investigate-and-respond-to-threats/threat-management">threat-management</a></td></tr><tr><td><p><i class="fa-globe">:globe:</i> Attack Surface Management</p><p>Discover and assess internet-facing attack surface risks.</p></td><td><a href="../detect-investigate-and-respond-to-threats/attack-surface-management">attack-surface-management</a></td></tr><tr><td><p><i class="fa-bug">:bug:</i> Vulnerability management</p><p>Identify, prioritize, and remediate vulnerabilities.</p></td><td><a href="../detect-investigate-and-respond-to-threats/vulnerability-management">vulnerability-management</a></td></tr><tr><td><p><i class="fa-radar">:radar:</i> Exposure management</p><p>Understand and reduce your overall cyber exposure.</p></td><td><a href="../detect-investigate-and-respond-to-threats/exposure-management">exposure-management</a></td></tr></tbody></table>
  +<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-chart-line">:chart-line:</i> Monitor dashboards and reports</p><p>Track security operations, trends, and outcomes.</p></td><td><a href="../detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports">monitor-dashboards-and-reports</a></td></tr><tr><td><p><i class="fa-magnifying-glass">:magnifying-glass:</i> Investigation and response</p><p>Investigate cases/issues and respond to threats.</p></td><td><a href="../detect-investigate-and-respond-to-threats/investigation-and-response">investigation-and-response</a></td></tr><tr><td><p><i class="fa-comments">:comments:</i> Agentic Assistant chat</p><p>Use natural language to investigate security data.</p></td><td><a href="../detect-investigate-and-respond-to-threats/agentic-assistant-chat">agentic-assistant-chat</a></td></tr><tr><td><p><i class="fa-boxes-stacked">:boxes-stacked:</i> Asset management</p><p>Inventory and monitor assets across your environment.</p></td><td><a href="../detect-investigate-and-respond-to-threats/asset-management">asset-management</a></td></tr><tr><td><p><i class="fa-crosshairs">:crosshairs:</i> Threats</p><p>Prioritize and manage threats affecting your organization.</p></td><td><a href="../detect-investigate-and-respond-to-threats/threat-management">threat-management</a></td></tr><tr><td><p><i class="fa-globe">:globe:</i> Attack Surface Management</p><p>Discover and assess internet-facing attack surface risks.</p></td><td><a href="../detect-investigate-and-respond-to-threats/attack-surface-management">attack-surface-management</a></td></tr><tr><td><p><i class="fa-bug">:bug:</i> Vulnerability management</p><p>Identify, prioritize, and remediate vulnerabilities.</p></td><td><a href="../detect-investigate-and-respond-to-threats/vulnerability-management">vulnerability-management</a></td></tr><tr><td><p><i class="fa-radar">:radar:</i> Exposure management</p><p>Understand and reduce your overall cyber exposure.</p></td><td><a href="../detect-investigate-and-respond-to-threats/exposure-management">exposure-management</a></td></tr></tbody></table>
   
   ### Cloud Security
   
   <table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-database">:database:</i> Data Security</p><p>Discover and protect sensitive cloud data.</p></td><td><a href="../cloud-security/cortex-data-security">cortex-data-security</a></td></tr><tr><td><p><i class="fa-scale-balanced">:scale-balanced:</i> Monitor and track compliance adherence</p><p>Measure cloud compliance against supported standards.</p></td><td><a href="../cloud-security/monitor-and-track-compliance-adherence">monitor-and-track-compliance-adherence</a></td></tr><tr><td><p><i class="fa-shield">:shield:</i> Cloud Security Rules and Policies</p><p>Configure policies and rules for cloud protection.</p></td><td><a href="../cloud-security/cloud-security-rules-and-policies">cloud-security-rules-and-policies</a></td></tr><tr><td><p><i class="fa-tags">:tags:</i> Cloud Data Classification</p><p>Classify cloud data using sensitive data profiles.</p></td><td><a href="../cloud-security/cortex-cloud-data-classification">cortex-cloud-data-classification</a></td></tr><tr><td><p><i class="fa-user-shield">:user-shield:</i> Cloud Identity Security</p><p>Secure cloud identities and their permissions.</p></td><td><a href="../cloud-security/cortex-cloud-identity-security">cortex-cloud-identity-security</a></td></tr><tr><td><p><i class="fa-network-wired">:network-wired:</i> Network exposure detection</p><p>Identify cloud network paths that create exposure.</p></td><td><a href="../cloud-security/network-exposure-detection">network-exposure-detection</a></td></tr><tr><td><p><i class="fa-brain">:brain:</i> Cloud AI Security</p><p>Secure AI services and workloads in the cloud.</p></td><td><a href="../cloud-security/cortex-cloud-ai-security">cortex-cloud-ai-security</a></td></tr><tr><td><p><i class="fa-bolt">:bolt:</i> Serverless function posture security</p><p>Assess configuration risks in serverless functions.</p></td><td><a href="../cloud-security/serverless-function-posture-security">serverless-function-posture-security</a></td></tr><tr><td><p><i class="fa-code">:code:</i> Cloud Application Security</p><p>Protect cloud-native applications across their lifecycle.</p></td><td><a href="../cloud-security/cortex-cloud-application-security">cortex-cloud-application-security</a></td></tr><tr><td><p><i class="fa-cloud">:cloud:</i> Cloud workload policies and rules</p><p>Define controls for cloud workloads and resources.</p></td><td><a href="../cloud-security/cloud-workload-policies-and-rules">cloud-workload-policies-and-rules</a></td></tr><tr><td><p><i class="fa-globe">:globe:</i> Web and API Security (WAAS)</p><p>Protect web applications and APIs from attacks.</p></td><td><a href="../cloud-security/overview">overview</a></td></tr><tr><td><p><i class="fa-play">:play:</i> Serverless function runtime security</p><p>Detect runtime threats in serverless functions.</p></td><td><a href="../cloud-security/overview-1">overview-1</a></td></tr><tr><td><p><i class="fa-envelope-open-text">:envelope-open-text:</i> Cortex Advanced Email Security</p><p>Protect users from email-based threats.</p></td><td><a href="../detect-investigate-and-respond-to-threats/cortex-advanced-email-security">cortex-advanced-email-security</a></td></tr></tbody></table>
   
   ### Reference and developer docs
   
  -<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-terminal">:terminal:</i> Cortex XSIAM XQL</p><p>Query and analyze security data with XQL.</p></td><td><a href="../reference-and-developer-docs/cortex-agentix-xql">cortex-agentix-xql</a></td></tr><tr><td><p><i class="fa-share-nodes">:share-nodes:</i> Graph Search</p><p>Explore relationships between entities and events.</p></td><td><a href="../reference-and-developer-docs/graph-search">graph-search</a></td></tr><tr><td><p><i class="fa-terminal">:terminal:</i> Cortex CLI</p><p>Manage Cortex XSIAM from the command line.</p></td><td><a href="../reference-and-developer-docs/about-cortex-cli">about-cortex-cli</a></td></tr><tr><td><p><i class="fa-user-lock">:user-lock:</i> Role-Based Access Control</p><p>Control access with roles and permissions.</p></td><td><a href="../reference-and-developer-docs/role-based-access-control">role-based-access-control</a></td></tr><tr><td><p><i class="fa-code">:code:</i> API documentation</p><p>Integrate Cortex XSIAM with its public APIs.</p></td><td><a href="../reference-and-developer-docs/api-documentation">api-documentation</a></td></tr><tr><td><p><i class="fa-book-open">:book-open:</i> Reference</p><p>Find detailed product and configuration reference material.</p></td><td><a href="../reference-and-developer-docs/reference">reference</a></td></tr></tbody></table>
  +<table data-view="cards"><thead><tr><th></th><th data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><p><i class="fa-terminal">:terminal:</i> XQL</p><p>Query and analyze security data with XQL.</p></td><td><a href="../reference-and-developer-docs/cortex-agentix-xql">cortex-agentix-xql</a></td></tr><tr><td><p><i class="fa-share-nodes">:share-nodes:</i> Graph Search</p><p>Explore relationships between entities and events.</p></td><td><a href="../reference-and-developer-docs/graph-search">graph-search</a></td></tr><tr><td><p><i class="fa-terminal">:terminal:</i> Cortex CLI</p><p>Manage Cortex XSIAM from the command line.</p></td><td><a href="../reference-and-developer-docs/about-cortex-cli">about-cortex-cli</a></td></tr><tr><td><p><i class="fa-user-lock">:user-lock:</i> Role-Based Access Control</p><p>Control access with roles and permissions.</p></td><td><a href="../reference-and-developer-docs/role-based-access-control">role-based-access-control</a></td></tr><tr><td><p><i class="fa-code">:code:</i> API documentation</p><p>Integrate Cortex XSIAM with its public APIs.</p></td><td><a href="../reference-and-developer-docs/api-documentation">api-documentation</a></td></tr></tbody></table>