Documentation — August 24, 2026

425 files changed, 2652 insertions, 1119 deletions — view the commit on the mirror.

Editorial pass over 424 XSIAM pages: 276 gain search descriptions, two lose reference detail

276 pages gained a description frontmatter block and 73 more had theirs rewritten, a metadata pass covering most of the Cortex XSIAM book.
Headings and prose were rewritten to name Cortex XSIAM explicitly, and the multi-tenant child tenant pages moved from Incidents and Alerts to Cases and Issues.
Two pages lost reference detail: the node icons table in the causality icons key, and the step-by-step rule criteria in Set up case scoring.
Twelve stub section pages gained child page indexes, and three pages had collapsible sections flattened into ordinary headings.
No page was added, removed or renamed; nine navigation titles changed, but every path stayed put.

Highlights

The causality icons key lost its node icons table

Twenty-three lines of node icon rows were deleted, leaving the section heading and its one-line introduction with nothing beneath them.
Set up case scoring dropped its step-by-step rule criteria

The substeps covering rule name, score, base rule, the apply-to-first-issue-only option and filter selection were replaced by the worked example alone.
Child tenant management now says Cases and Issues, not Incidents and Alerts

Across three multi-tenant pages the parent tenant's viewable page list and its configurable actions were renamed, including Starred Issue Policies and Issue Exclusions.
276 pages gained a search description

Pages that carried no frontmatter description now have one, and 73 existing descriptions were rewritten to name the product and the task.
Device control was restructured and rebranded

The page gained capabilities, prerequisites and limitations headings, and the Cortex XDR references in its Bluetooth limitation rows became Cortex XSIAM.
Twelve stub section pages gained child page indexes

Cloud Identity Security, Endpoint DLP and Remote repository management were one-line stubs that now list the pages beneath them.

Bulk change — 425 files. Per-file diffs are not stored for a change this size; view it on the mirror.

Changes

425 files listed, 15 written up and shaded below.

▸ ▾ Add a support exception rule for endpoints modified +6 −0 xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-support-exception-rule-for-endpoints

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Add an IOC or BIOC rule exception modified +4 −0 xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-an-ioc-or-bioc-rule-exception

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Exception configuration modified +6 −6 xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/exception-configuration

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue exclusions modified +6 −0 xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Add an issue exclusion rule modified +6 −0 xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions/add-an-issue-exclusion-rule

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up exploit prevention profiles modified +10 −6 xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exploit-prevention-profiles

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up Identity profiles modified +7 −3 xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-identity-profiles

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up malware prevention profiles modified +6 −2 xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-malware-prevention-profiles

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up restrictions prevention profiles modified +6 −0 xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-restrictions-prevention-profiles

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Reference modified +6 −0 xsiam/reference-and-developer-docs/reference

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cloud service provider permissions modified +3 −1 xsiam/reference-and-developer-docs/reference/cloud-service-provider-permissions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Network Scanner OSS modified +6 −0 xsiam/reference-and-developer-docs/reference/cortex-network-scanner-oss

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Fair Usage policy for Cortex XSIAM modified +6 −0 xsiam/reference-and-developer-docs/reference/fair-usage-policy-for-cortex-xsiam

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Microsoft Windows security auditing setup modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enable additional event logs using Event Viewer modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-additional-event-logs-using-event-viewer

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enable LDAP server events logging (1644) modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enable LDAP server events logging using GPO modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-gpo

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enable LDAP server events logging using RegEdit modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-regedit

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Validate log collection for LDAP Server events modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/validate-log-collection-for-ldap-server-events

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enable security auditing event IDs modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Additional setup for Active Directory Certificate Services (ADCS) events modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/additional-setup-for-active-directory-certificate-services-adcs-events

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enable auditing access to AD domain objects - 4662 modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-auditing-access-to-ad-domain-objects-4662

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enable security auditing event IDs with GPO modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-security-auditing-event-ids-with-gpo

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up local machine security auditing without GPO modified +6 −0 xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/set-up-local-machine-security-auditing-with-gpo

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ XDM fields for mapping authentication events modified +2 −2 xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-authentication-events

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.