Documentation — August 25, 2026

▸ README modified +1 −1 README

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

▸ Navigation manifest (xsiam) modified +2 −391 .meta/xsiam

The book's page tree and ordering — not a documentation page, so no diff is kept. The counts above still say how much moved.

▸ Troubleshooting Resources for Linux modified +1 −1 agent/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,9 +1,9 @@

---

description: >-

Refer to the following troubleshooting resources for the Cortex XDR agent for

Linux.

---

# Troubleshooting Resources for Linux


Resource	Description
Services and Processes	Services: `/opt/traps/bin/pmd`‑ Running with root privileges. Processes: `/opt/traps/bin/dypd` or `/opt/traps/bin/dypdng` (depending on the Linux kernel version) - Running with root privileges, `pmd` starts and stops a single `dypd` helper process. `/opt/traps/analyzerd/clad`- Unprivileged process running inside the sandbox, `pmd` starts and stops a single `analyzerd` helper process. `/opt/traps/analyzerd/spmd`‑ Unprivileged process running inside the sandbox, `pmd` starts and stops a single `analyzerd` helper process. `/opt/traps/python/payload/lted`‑ Unprivileged process running inside the sandbox, `pmd` starts and stops multiple `lted` processes on demand. `/opt/traps/python/payload/pyxd`
Memory usage of lted processes	All `lted` instances are forks of the same process, sharing most of the physical memory pages. Using `ps` and sum of RSS of all `lted` instances could be misleading, since the same shared memory pages will be counted several times. The correct way to analyze memory usage of `lted` processes is using PSS (Proportional set size), which can be calculated by the `smem` utility.
Cortex XDR agent logs	Indicates information, warnings, and errors related to Cortex XDR that are stored on the endpoint, accessible to privileged users only. Installation logs: `/var/log/traps-install.log` Agent logs: `/var/log/traps/`
Kernel Module	The installed Cortex XDR agent kernel module. Kernel modules are updated through Content updates. See the admin guide for more information about content updates. Latest content releases are listed here. For supported Kernel Modules see here. /lib/modules/$<`uname -r`>/traps/traps.ko


Resource	Description
Services and Processes	Services: `/opt/traps/bin/pmd`‑ Running with root privileges. Processes: `/opt/traps/bin/dypd` or `/opt/traps/bin/dypdng` (depending on the Linux kernel version) - Running with root privileges, `pmd` starts and stops a single `dypd` helper process. `/opt/traps/analyzerd/clad`- Unprivileged process running inside the sandbox, `pmd` starts and stops a single `analyzerd` helper process. `/opt/traps/analyzerd/spmd`‑ Unprivileged process running inside the sandbox, `pmd` starts and stops a single `analyzerd` helper process. `/opt/traps/python/payload/lted`‑ Unprivileged process running inside the sandbox, `pmd` starts and stops multiple `lted` processes on demand. `/opt/traps/python/payload/pyxd`
Memory usage of lted processes	All `lted` instances are forks of the same process, sharing most of the physical memory pages. Using `ps` and sum of RSS of all `lted` instances could be misleading, since the same shared memory pages will be counted several times. The correct way to analyze memory usage of `lted` processes is using PSS (Proportional set size), which can be calculated by the `smem` utility.
Cortex XDR agent logs	Indicates information, warnings, and errors related to Cortex XDR that are stored on the endpoint, accessible to privileged users only. Installation logs: `/var/log/traps-install.log` Agent logs: `/var/log/traps/`
Kernel Module	The installed Cortex XDR agent kernel module. Kernel modules are updated through Content updates. See the admin guide for more information about content updates. Latest content releases are listed here. For supported Kernel Modules see here. /lib/modules/$<`uname -r`>/traps/traps.ko

Show markdown source

@@ -1,9 +1,9 @@
 ---
 description: >-
   Refer to the following troubleshooting resources for the Cortex XDR agent for
   Linux.
 ---
 
 # Troubleshooting Resources for Linux
 
-<table data-header-hidden><thead><tr><th width="305.7352294921875"></th><th></th></tr></thead><tbody><tr><td>Resource</td><td>Description</td></tr><tr><td>Services and Processes</td><td><p>Services:</p><ul><li><code>/opt/traps/bin/pmd</code>‑ Running with root privileges.</li></ul><p>Processes:</p><ul><li><code>/opt/traps/bin/dypd</code> or <code>/opt/traps/bin/dypdng</code> (depending on the Linux kernel version) - Running with root privileges, <code>pmd</code> starts and stops a single <code>dypd</code> helper process.</li><li><code>/opt/traps/analyzerd/clad</code>- Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/analyzerd/spmd</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/python/payload/lted</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops multiple <code>lted</code> processes on demand.</li><li><code>/opt/traps/python/payload/pyxd</code></li></ul></td></tr><tr><td>Memory usage of lted processes</td><td>All <code>lted</code> instances are forks of the same process, sharing most of the physical memory pages. Using <code>ps</code> and sum of RSS of all <code>lted</code> instances could be misleading, since the same shared memory pages will be counted several times. The correct way to analyze memory usage of <code>lted</code> processes is using PSS (Proportional set size), which can be calculated by the <code>smem</code> utility.</td></tr><tr><td>Cortex XDR agent logs</td><td><p>Indicates information, warnings, and errors related to Cortex XDR that are stored on the endpoint, accessible to privileged users only.</p><ul><li>Installation logs: <code>/var/log/traps-install.log</code></li><li>Agent logs: <code>/var/log/traps/</code></li></ul></td></tr><tr><td>Kernel Module</td><td><p>The installed Cortex XDR agent kernel module. Kernel modules are updated through Content updates. See the admin guide for more information about content updates. Latest content releases are listed <a href="https://app.gitbook.com/s/JZVikp6ohjY6qBMfKrfn/">here</a>.</p><p>For supported Kernel Modules see <a href="https://app.gitbook.com/s/y29o8lwSBpbfPbvztsyt/#find-a-supported-kernel">here</a>.</p><ul><li>/lib/modules/$&#x3C;<strong><code>uname -r</code></strong>>/traps/traps.ko</li></ul></td></tr></tbody></table>
+<table data-header-hidden><thead><tr><th width="159.58935546875"></th><th width="590.2978515625"></th></tr></thead><tbody><tr><td>Resource</td><td>Description</td></tr><tr><td>Services and Processes</td><td><p>Services:</p><ul><li><code>/opt/traps/bin/pmd</code>‑ Running with root privileges.</li></ul><p>Processes:</p><ul><li><code>/opt/traps/bin/dypd</code> or <code>/opt/traps/bin/dypdng</code> (depending on the Linux kernel version) - Running with root privileges, <code>pmd</code> starts and stops a single <code>dypd</code> helper process.</li><li><code>/opt/traps/analyzerd/clad</code>- Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/analyzerd/spmd</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/python/payload/lted</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops multiple <code>lted</code> processes on demand.</li><li><code>/opt/traps/python/payload/pyxd</code></li></ul></td></tr><tr><td>Memory usage of lted processes</td><td>All <code>lted</code> instances are forks of the same process, sharing most of the physical memory pages. Using <code>ps</code> and sum of RSS of all <code>lted</code> instances could be misleading, since the same shared memory pages will be counted several times. The correct way to analyze memory usage of <code>lted</code> processes is using PSS (Proportional set size), which can be calculated by the <code>smem</code> utility.</td></tr><tr><td>Cortex XDR agent logs</td><td><p>Indicates information, warnings, and errors related to Cortex XDR that are stored on the endpoint, accessible to privileged users only.</p><ul><li>Installation logs: <code>/var/log/traps-install.log</code></li><li>Agent logs: <code>/var/log/traps/</code></li></ul></td></tr><tr><td>Kernel Module</td><td><p>The installed Cortex XDR agent kernel module. Kernel modules are updated through Content updates. See the admin guide for more information about content updates. Latest content releases are listed <a href="https://app.gitbook.com/s/JZVikp6ohjY6qBMfKrfn/">here</a>.</p><p>For supported Kernel Modules see <a href="https://app.gitbook.com/s/y29o8lwSBpbfPbvztsyt/#find-a-supported-kernel">here</a>.</p><ul><li>/lib/modules/$&#x3C;<strong><code>uname -r</code></strong>>/traps/traps.ko</li></ul></td></tr></tbody></table>

▸ Cytool for Linux modified +43 −1 agent/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux/cytool-for-linux

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -12,9 +12,51 @@ Cytool is a command-line tool that is integrated into the Cortex XDR agent that

The following table displays the Cytool options available on Linux endpoints. Where there is a password required for admin commands, this is the same password as was defined as the Uninstall Password.

hint info

### Note

Since Cortex XDR agent 7.6, the pmd process includes and replaces the trapsd process.

endhint


Command Option	Description
`adaptive_policy`	Adaptive policy agent commands. Usage: `cytool adaptive_policy [<interval> <collect_stats> <recalc> <query>]` where: `interval` —Sets a recalculation interval override (in seconds), or reset an override. Options are: `seconds`, `policy` `collect_stats` —Initiates a collection of internal statistics. `recalc` —Triggers a recalculation of the adaptive policy. `query` —Query the current interval and APEX.
`anti_malware`	Perform Anti Malware related operations. [version <query> \| cache <print, status>] Usage: `cytool anti_malware` `<version>` `<cache>` where: version — Input: `query` cache — Input: `print` `status` la, wf, and ltee are for internal use.
`cert_enforcement`	Perform Certificate enforcement related operations. Usage: `cytool cert_enforcement <operation>` Where <operation> is one of the following: query Display current enforcement status disable Forcibly disable enforcement policy Set enforcement by policy import <certificate file path> Import a proprietary certificate in PEM format as root CA import clear Clear all custom root CA certificates.
`checkin`	Initiate check-in to the server. Usage: `cytool checkin` To verify the check in, view the check-in time on the Cortex XDR agent console.
`connectivity_test`	Perform a connectivity test to Cortex XDR servers. Usage: `cytool connectivity_test [request_count]`
`dump`	Enable/disable dump generation or restore policy settings. Usage: `cytool dump enable` `cytool dump disable` `cytool dump restore`
`endpoint_tags`	Usage: `cytool endpoint_tags` `<action>` where <action> can be: add—To add tags to the endpoint tags. remove—Remove the given tags from the list of endpoint tags. list—Displays the available endpoint tags. Note Tags should be passed as one string separated by comas. Linux does not support tag names with spaces as command line arguments to the shell installer. Instead, tags can be set in the `/etc/panw/cortex.conf` configuration file, that supports all Linux installers. For example: `cytool endpoint_tags add "tag1[,tag2,...,tagN]"` `cytool endpoint_tags remove "tag1[,tag2,...,tagN]"` `cytool endpoint_tags list`
`enum`	Enumerate protected processes. Usage: `cytool enum` For example: `root@ubuntu: cytool enum ----------------------------------- Cortex XDR list of protected processes: ----------------------------------- PID CMD UID 1098 /usr/sbin/cron -f 0 1131 /usr/sbin/rsyslogd -n 104` To view processes for all users including those initiated by the operating system, specify the `/a` option. Note If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes; only then you will see them on this list.
`event_collection`	Stop or start event collection status (EDR/DSE). <query, enable, disable, logstat>
`health`	Shows the agent status, protection level and connectivity.
`-h --help`	Displays the available help information
`import suex`	Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.
`isolate stop`	Release machine from network isolation.
`last_checkin`	Display last successful check-in time.
`log`	Set the log level for the desired process. Usage: `cytool log set_level <log_level> <components>` where: `<log_level>` is an integer value corresponding to the log level: 0—Disable logging 1—Fatal 2—Critical 3—Error 4—Warning 5—Notice 6—Information 7—Debug 8—Trace `<components>` is `all` or one or more of the following agent components: `authorized`, `pmd`, `cortex xdr`, `kproc-ctrl`. For example: `cytool log set_level 2 all` Then use the `cytool log collect` command to generate a support file.
`log collect`	Generate support file archive of all logs in a TGZ file.
`persist`	The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events. Use cytool persist operations to import, export, and view information stored in the local database. Usage: `cytool persist <action>` where <action>: `list`—List the local databases on the endpoint. **`export [
`queryall`	The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.
`reconnect`	Try reconnecting to the server if communication has been disabled, or force registration with a new `distribution_id`. Usage: `cytool reconnect`—Reconnects the Cortex XDR agent to the management application on the server. `cytool reconnect [force <distribution_id]>` Note The `distribution_id` must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.
`runtime`	Stop or start product components. Usage: `cytool runtime <action> <component>` where: `<action>`—Change startup runtime action for an agent component. Options are: `start`, `stop`, `query`. The query option displays the startup status for each component. `<component>`—Target components for which to set the runtime action, or `all` components. To change the runtime action for multiple components, list them with spaces separating each component. Options: `cortex xdr`, `authorized`, `pmd`, `kproc-ctrl` For example: cytool runtime query Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl cytool runtime stop all Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A cytool runtime start all Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl
`scan`	Perform Scan operations on the endpoint. Options: `start`, `stop`, `query`
`startup`	Enable, disable, or query the startup state of Cortex XDR agent components. Usage: `cytool startup` `<action>` `<component>` where: `<action>`—Change startup action for an agent component. Options are: `enable`, `disable`, `query`. The query option displays the startup status for each component. `<component>`—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: `cortex xdr`, `authorized`, `pmd`, `kproc-ctrl` For example: `root@ubuntu: sudo ./cytool startup disable cortex xdr pmd Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded root@ubuntu: sudo ./cytool startup enable all Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded`


Command Option	Description
adaptive_policy	Adaptive policy agent commands. Usage: `cytool adaptive_policy [<interval> <collect_stats> <recalc> <query>]` where: `interval` —Sets a recalculation interval override (in seconds), or reset an override. Options are: `seconds`, `policy` `collect_stats` —Initiates a collection of internal statistics `recalc` —Triggers a recalculation of the adaptive policy `query` —Queries the current interval and APEX
anti_malware	Perform Anti Malware related operations. `[version <query> \| cache <print, status>]` Usage: `cytool anti_malware` `<version>` `<cache>` where: `version` — Input: `query` `cache` — Input: `print` `status` la, wf, and ltee are for internal use
cert_enforcement	Perform Certificate enforcement related operations. Usage: `cytool cert_enforcement <operation>` Where <operation> is one of the following: `query` —Displays current enforcement status `disable` —Forcibly disables enforcement `policy` —Sets enforcement by policy `import <certificate file path>` —Imports a proprietary certificate in PEM format as root CA `import clear` —Clears all custom root CA certificates
checkin	Initiate check-in to the server. Usage: `cytool checkin` To verify the check in, view the check-in time on the Cortex XDR agent console.
connectivity_test	Perform a connectivity test to Cortex XDR servers. Usage: `cytool connectivity_test [request_count]`
dump	Enable/disable dump generation or restore policy settings. Usage: `cytool dump enable` `cytool dump disable` `cytool dump restore`
endpoint_tags	Usage: `cytool endpoint_tags` `<action>` where <action> can be: `add`—Adds tags to the endpoint tags. `remove`—Removes the given tags from the list of endpoint tags. `list`—Displays the available endpoint tags. Note Tags should be passed as one string separated by comas. Linux does not support tag names with spaces as command line arguments to the shell installer. Instead, tags can be set in the `/etc/panw/cortex.conf` configuration file, that supports all Linux installers. For example: `cytool endpoint_tags add "tag1[,tag2,...,tagN]"` `cytool endpoint_tags remove "tag1[,tag2,...,tagN]"` `cytool endpoint_tags list`
enum	Enumerate protected processes. Usage: `cytool enum` For example: `root@ubuntu: cytool enum`

-----------------------------------

Cortex XDR list of protected processes:

-----------------------------------

PID CMD UID

1098 /usr/sbin/cron -f 0

1131 /usr/sbin/rsyslogd -n 104

</code></pre>To view processes for all users including those initiated by the operating system, specify the /a option.<div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info">NoteIf you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes; only then you will see them on this list.</div></td></tr><tr><td>event_collection</td><td>Stop or start event collection status (EDR/DSE).Usage: cytool event_collection <operation> Options are: query, enable, disable, logstat.</td></tr><tr><td>health</td><td>Shows the agent status, protection level and connectivity.</td></tr><tr><td>-h --help</td><td>Displays the available help information</td></tr><tr><td>import suex</td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>isolate stop</td><td>Release machine from network isolation.</td></tr><tr><td>last_checkin</td><td>Display last successful check-in time.</td></tr><tr><td>log</td><td>Set the log level for the desired process.Usage: cytool log set_level <log_level> <components>where:<ul><li><log_level> is an integer value corresponding to the log level:<ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li><components> is all or one or more of the following agent components: authorized, pmd, cortex xdr, kproc-ctrl.</li></ul>For example:<pre>cytool log set_level 2 all

</code></pre>Then use the cytool log collect command to generate a support file.</td></tr><tr><td>log collect</td><td>Generate support file archive of all logs in a TGZ file.</td></tr><tr><td>persist</td><td>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events. Use cytool persist operations to import, export, and view information stored in the local database.Usage: cytool persist <action>where <action>:<ul><li>list—List the local databases on the endpoint.</li><li>export [<database name> | <databasepath>]—Export database table to a file in the /Library/Application Support/PaloAltoNetworks/Traps/bin/ directory.</li><li>import [<database name> | <databasepath>] <file name>—Add records in a JSON file to the database.</li><li>print <database name> | <databasepath>—Print the database, in comma-separated values (CSV) format, to the command prompt.</li></ul>To view a list of all local databases, use the cytool persist list command.</td></tr><tr><td>queryall</td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td>reconnect</td><td>Try reconnecting to the server if communication has been disabled, or force registration with a new distribution_id.Usage:<ul><li>cytool reconnect—Reconnects the Cortex XDR agent to the management application on the server.</li><li>cytool reconnect [force <distribution_id]></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info">NoteThe distribution_id must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</div></td></tr><tr><td>runtime</td><td>Stop or start product components.Usage: cytool runtime <action> <component>where:<ul><li><action>—Change startup runtime action for an agent component.Options are: start, stop, query. The query option displays the startup status for each component.</li><li><component>—Target components for which to set the runtime action, or all components.To change the runtime action for multiple components, list them with spaces separating each component.Options: cortex xdr, authorized, pmd, kproc-ctrl</li></ul>For example:<pre>cytool runtime query

Name PID User Status Command

cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr

authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized

pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd

kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl

cytool runtime stop all

Name PID User Status Command

authorized N/A N/A STOPPED N/A

pmd N/A N/A STOPPED N/A

cortex xdr N/A N/A STOPPED N/A

kproc-ctrl N/A N/A Unloaded N/A

cytool runtime start all

Name PID User Status Command

system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768

authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized

pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd

cortex xdr N/A N/A FAILED TO START N/A

kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl

</code></pre></td></tr><tr><td>scan</td><td>Perform Scan operations on the endpoint.Options: start, stop, query</td></tr><tr><td>startup</td><td>Enable, disable, or query the startup state of Cortex XDR agent components.Usage: cytool startup <action> <component>where:<ul><li><action>—Change startup action for an agent component.Options are: enable, disable, query.The query option displays the startup status for each component.</li><li><component>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: cortex xdr, authorized, pmd, kproc-ctrl </li></ul>For example:<pre>root@ubuntu: sudo ./cytool startup disable cortex xdr pmd

Process name Startup status

cortex xdr Disabled

authorized Enabled

pmd Disabled

kproc-ctrl Loaded

root@ubuntu: sudo ./cytool startup enable all

Process name Startup status

cortex xdr Enabled

authorized Enabled

pmd Enabled

kproc-ctrl Loaded

</code></pre></td></tr></tbody></table>

Show markdown source

@@ -12,9 +12,51 @@ Cytool is a command-line tool that is integrated into the Cortex XDR agent that
 The following table displays the Cytool options available on Linux endpoints. Where there is a password required for admin commands, this is the same password as was defined as the Uninstall Password.
 
 {% hint style="info" %}
 ### Note
 
 Since Cortex XDR agent 7.6, the `pmd` process includes and replaces the `trapsd` process.
 {% endhint %}
 
-<table data-header-hidden><thead><tr><th width="232.436767578125"></th><th></th></tr></thead><tbody><tr><td>Command Option</td><td>Description</td></tr><tr><td><code>adaptive_policy</code></td><td><p>Adaptive policy agent commands.</p><p>Usage: <code>cytool adaptive_policy [&#x3C;interval> &#x3C;collect_stats> &#x3C;recalc> &#x3C;query>]</code></p><p>where:</p><ul><li><strong><code>interval</code></strong> —Sets a recalculation interval override (in seconds), or reset an override. Options are: <code>seconds</code>, <code>policy</code></li><li><strong><code>collect_stats</code></strong> —Initiates a collection of internal statistics.</li><li><strong><code>recalc</code></strong> —Triggers a recalculation of the adaptive policy.</li><li><strong><code>query</code></strong> —Query the current interval and APEX.</li></ul></td></tr><tr><td><code>anti_malware</code></td><td><p>Perform Anti Malware related operations.</p><p>[version &#x3C;query> | cache &#x3C;print, status>]</p><p>Usage: <strong><code>cytool anti_malware </code></strong><em><strong><code>&#x3C;version></code></strong></em> <em><strong><code>&#x3C;cache></code></strong></em></p><p>where:</p><ul><li>version — Input: <strong><code>query</code></strong></li><li>cache — Input: <strong><code>print</code></strong> <strong><code>status</code></strong></li><li>la, wf, and ltee are for internal use.</li></ul></td></tr><tr><td><code>cert_enforcement</code></td><td><p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li>query                       Display current enforcement status</li><li>disable                     Forcibly disable enforcement</li><li>policy                      Set enforcement by policy</li><li>import &#x3C;certificate file path>     Import a proprietary certificate in PEM format as root CA</li><li>import clear                       Clear all custom root CA certificates.</li></ul></td></tr><tr><td><code>checkin</code></td><td><p>Initiate check-in to the server.</p><p>Usage: <strong><code>cytool checkin</code></strong></p><p>To verify the check in, view the check-in time on the Cortex XDR agent console.</p></td></tr><tr><td><code>connectivity_test</code></td><td><p>Perform a connectivity test to Cortex XDR servers.</p><p>Usage: <code>cytool connectivity_test [request_count]</code></p></td></tr><tr><td><code>dump</code></td><td><p>Enable/disable dump generation or restore policy settings.</p><p>Usage:</p><ul><li><code>cytool dump enable</code></li><li><code>cytool dump disable</code></li><li><code>cytool dump restore</code></li></ul></td></tr><tr><td><code>endpoint_tags</code></td><td><p>Usage: <strong><code>cytool endpoint_tags </code></strong><em><strong><code>&#x3C;action></code></strong></em></p><p>where &#x3C;action> can be:</p><ul><li>add—To add tags to the endpoint tags.</li><li>remove—Remove the given tags from the list of endpoint tags.</li><li>list—Displays the available endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string separated by comas.</p><p>Linux does not support tag names with spaces as command line arguments to the shell installer.</p><p>Instead, tags can be set in the <code>/etc/panw/cortex.conf</code> configuration file, that supports all Linux installers.</p></div><p>For example:</p><ul><li><code>cytool endpoint_tags add "tag1[,tag2,...,tagN]"</code></li><li><code>cytool endpoint_tags remove "tag1[,tag2,...,tagN]"</code></li><li><code>cytool endpoint_tags list</code></li></ul></td></tr><tr><td><code>enum</code></td><td><p>Enumerate protected processes.</p><p>Usage: <strong><code>cytool enum</code></strong></p><p>For example:</p><p><code>root@ubuntu: cytool enum ----------------------------------- Cortex XDR list of protected processes: ----------------------------------- PID CMD UID 1098 /usr/sbin/cron -f 0 1131 /usr/sbin/rsyslogd -n 104</code></p><p>To view processes for all users including those initiated by the operating system, specify the <code>/a</code> option.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes; only then you will see them on this list.</p></div></td></tr><tr><td><code>event_collection</code></td><td><p>Stop or start event collection status (EDR/DSE).</p><p>&#x3C;query, enable, disable, logstat></p></td></tr><tr><td><code>health</code></td><td>Shows the agent status, protection level and connectivity.</td></tr><tr><td><code>-h --help</code></td><td>Displays the available help information</td></tr><tr><td><code>import suex</code></td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td><code>isolate stop</code></td><td>Release machine from network isolation.</td></tr><tr><td><code>last_checkin</code></td><td>Display last successful check-in time.</td></tr><tr><td><code>log</code></td><td><p>Set the log level for the desired process.</p><p>Usage: <strong><code>cytool log set_level &#x3C;log_level> &#x3C;components></code></strong></p><p>where:</p><ul><li><p><code>&#x3C;log_level></code> is an integer value corresponding to the log level:</p><ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li><code>&#x3C;components></code> is <strong><code>all</code></strong> or one or more of the following agent components: <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>cortex xdr</code></strong>, <strong><code>kproc-ctrl</code></strong>.</li></ul><p>For example:</p><p><strong><code>cytool log set_level 2 all</code></strong></p><p>Then use the <strong><code>cytool log collect</code></strong> command to generate a support file.</p></td></tr><tr><td><code>log collect</code></td><td>Generate support file archive of all logs in a TGZ file.</td></tr><tr><td><code>persist</code></td><td><p>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events. Use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <strong><code>cytool persist &#x3C;action></code></strong></p><p>where &#x3C;action>:</p><ul><li><strong><code>list</code></strong>—List the local databases on the endpoint.</li><li>**`export [</li></ul></td></tr><tr><td><code>queryall</code></td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td><code>reconnect</code></td><td><p></p><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div></td></tr><tr><td><code>runtime</code></td><td><p>Stop or start product components.</p><p>Usage: <code>cytool runtime &#x3C;action> &#x3C;component></code></p><p>where:</p><ul><li><p><strong><code>&#x3C;action></code></strong>—Change startup runtime action for an agent component.</p><p>Options are: <strong><code>start</code></strong>, <strong><code>stop</code></strong>, <strong><code>query</code></strong>. The query option displays the startup status for each component.</p></li><li><p><strong><code>&#x3C;component></code></strong>—Target components for which to set the runtime action, or <code>all</code> components.</p><p>To change the runtime action for multiple components, list them with spaces separating each component.</p><p>Options: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></p></li></ul><p>For example:</p><p><code>cytool runtime query Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl cytool runtime stop all Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A cytool runtime start all Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl</code></p></td></tr><tr><td><code>scan</code></td><td><p>Perform Scan operations on the endpoint.</p><p>Options: <code>start</code>, <code>stop</code>, <code>query</code></p></td></tr><tr><td><code>startup</code></td><td><p>Enable, disable, or query the startup state of Cortex XDR agent components.</p><p>Usage: <strong><code>cytool startup </code></strong><em><strong><code>&#x3C;action></code></strong></em> <em><strong><code>&#x3C;component></code></strong></em></p><p>where:</p><ul><li><p><strong><code>&#x3C;action></code></strong>—Change startup action for an agent component.</p><p>Options are: <strong><code>enable</code></strong>, <strong><code>disable</code></strong>, <strong><code>query</code></strong>.</p><p>The query option displays the startup status for each component.</p></li><li><strong><code>&#x3C;component></code></strong>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></li></ul><p>For example:</p><p><code>root@ubuntu: sudo ./cytool startup disable cortex xdr pmd Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded root@ubuntu: sudo ./cytool startup enable all Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded</code></p></td></tr></tbody></table>
+<table data-header-hidden><thead><tr><th width="204.27703857421875"></th><th width="559.52587890625"></th></tr></thead><tbody><tr><td>Command Option</td><td>Description</td></tr><tr><td>adaptive_policy</td><td><p>Adaptive policy agent commands.</p><p>Usage: <code>cytool adaptive_policy [&#x3C;interval> &#x3C;collect_stats> &#x3C;recalc> &#x3C;query>]</code></p><p>where:</p><ul><li><code>interval</code> —Sets a recalculation interval override (in seconds), or reset an override. Options are: <code>seconds</code>, <code>policy</code></li><li><code>collect_stats</code> —Initiates a collection of internal statistics</li><li><code>recalc</code> —Triggers a recalculation of the adaptive policy</li><li><code>query</code> —Queries the current interval and APEX</li></ul></td></tr><tr><td>anti_malware</td><td><p>Perform Anti Malware related operations.</p><p><code>[version &#x3C;query> | cache &#x3C;print, status>]</code></p><p>Usage: <code>cytool anti_malware </code><em><code>&#x3C;version></code></em> <em><code>&#x3C;cache></code></em></p><p>where:</p><ul><li><code>version</code> — Input: <code>query</code></li><li><code>cache</code> — Input: <code>print</code> <code>status</code></li><li>la, wf, and ltee are for internal use</li></ul></td></tr><tr><td>cert_enforcement</td><td><p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li><code>query</code> —Displays current enforcement status</li><li><code>disable</code> —Forcibly disables enforcement</li><li><code>policy</code> —Sets enforcement by policy</li><li><code>import &#x3C;certificate file path></code> —Imports a proprietary certificate in PEM format as root CA</li><li><code>import clear</code> —Clears all custom root CA certificates</li></ul></td></tr><tr><td>checkin</td><td><p>Initiate check-in to the server.</p><p>Usage: <code>cytool checkin</code></p><p>To verify the check in, view the check-in time on the Cortex XDR agent console.</p></td></tr><tr><td>connectivity_test</td><td><p>Perform a connectivity test to Cortex XDR servers.</p><p>Usage: <code>cytool connectivity_test [request_count]</code></p></td></tr><tr><td>dump</td><td><p>Enable/disable dump generation or restore policy settings.</p><p>Usage:</p><ul><li><code>cytool dump enable</code></li><li><code>cytool dump disable</code></li><li><code>cytool dump restore</code></li></ul></td></tr><tr><td>endpoint_tags</td><td><p>Usage: <code>cytool endpoint_tags </code><em><code>&#x3C;action></code></em></p><p>where &#x3C;action> can be:</p><ul><li><code>add</code>—Adds tags to the endpoint tags.</li><li><code>remove</code>—Removes the given tags from the list of endpoint tags.</li><li><code>list</code>—Displays the available endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string separated by comas.</p><p>Linux does not support tag names with spaces as command line arguments to the shell installer.</p><p>Instead, tags can be set in the <code>/etc/panw/cortex.conf</code> configuration file, that supports all Linux installers.</p></div><p>For example:</p><ul><li><code>cytool endpoint_tags add "tag1[,tag2,...,tagN]"</code></li><li><code>cytool endpoint_tags remove "tag1[,tag2,...,tagN]"</code></li><li><code>cytool endpoint_tags list</code></li></ul></td></tr><tr><td>enum</td><td><p>Enumerate protected processes.</p><p>Usage: <code>cytool enum</code></p><p>For example:</p><pre><code><strong>root@ubuntu: cytool enum
+</strong>-----------------------------------
+Cortex XDR list of protected processes:
+-----------------------------------
+  PID CMD                           UID
+ 1098 /usr/sbin/cron -f               0
+ 1131 /usr/sbin/rsyslogd -n         104
+
+</code></pre><p>To view processes for all users including those initiated by the operating system, specify the <code>/a</code> option.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes; only then you will see them on this list.</p></div></td></tr><tr><td>event_collection</td><td><p>Stop or start event collection status (EDR/DSE).</p><p>Usage: <code>cytool event_collection &#x3C;operation></code> </p><p>Options are: <code>query</code>, <code>enable</code>, <code>disable</code>, <code>logstat.</code></p></td></tr><tr><td>health</td><td>Shows the agent status, protection level and connectivity.</td></tr><tr><td>-h --help</td><td>Displays the available help information</td></tr><tr><td>import suex</td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>isolate stop</td><td>Release machine from network isolation.</td></tr><tr><td>last_checkin</td><td>Display last successful check-in time.</td></tr><tr><td>log</td><td><p>Set the log level for the desired process.</p><p>Usage: <code>cytool log set_level &#x3C;log_level> &#x3C;components></code></p><p>where:</p><ul><li><p>&#x3C;log_level> is an integer value corresponding to the log level:</p><ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li>&#x3C;components> is <code>all</code> or one or more of the following agent components: <code>authorized</code>, <code>pmd</code>, <code>cortex xdr</code>, <code>kproc-ctrl</code>.</li></ul><p>For example:</p><pre><code><strong>cytool log set_level 2 all
+</strong></code></pre><p>Then use the <code>cytool log collect</code> command to generate a support file.</p></td></tr><tr><td>log collect</td><td>Generate support file archive of all logs in a TGZ file.</td></tr><tr><td>persist</td><td><p>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events. Use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <code>cytool persist &#x3C;action></code></p><p>where &#x3C;action>:</p><ul><li><code>list</code>—List the local databases on the endpoint.</li><li><code>export [&#x3C;database name> | &#x3C;databasepath>]</code>—Export database table to a file in the <code>/Library/Application Support/PaloAltoNetworks/Traps/bin/</code> directory.</li><li><code>import [&#x3C;database name> | &#x3C;databasepath>] &#x3C;file name></code>—Add records in a JSON file to the database.</li><li><code>print &#x3C;database name> | &#x3C;databasepath></code>—Print the database, in comma-separated values (CSV) format, to the command prompt.</li></ul><p>To view a list of all local databases, use the <code>cytool persist list</code> command.</p></td></tr><tr><td>queryall</td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td>reconnect</td><td><p></p><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div></td></tr><tr><td>runtime</td><td><p>Stop or start product components.</p><p>Usage: <code>cytool runtime &#x3C;action> &#x3C;component></code></p><p></p><p>where:</p><ul><li><p>&#x3C;action>—Change startup runtime action for an agent component.</p><p>Options are: <code>start</code>, <code>stop</code>, <code>query</code>. The query option displays the startup status for each component.</p></li><li><p>&#x3C;component>—Target components for which to set the runtime action, or <code>all</code> components.</p><p>To change the runtime action for multiple components, list them with spaces separating each component.</p><p>Options: <code>cortex xdr</code>, <code>authorized</code>, <code>pmd</code>, <code>kproc-ctrl</code></p></li></ul><p>For example:</p><pre><code><strong>cytool runtime query
+</strong>         Name    PID         User              Status		Command
+   cortex xdr   1055        User1             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr
+   authorized    927  _traps_panw             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/authorized
+          pmd    909         root             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd
+   kproc-ctrl    159         root              Loaded		com.paloaltonetworks.driver.kproc-ctrl
+
+<strong>cytool runtime stop all
+</strong>         Name    PID         User              Status		Command
+   authorized    N/A          N/A             STOPPED		N/A
+          pmd    N/A          N/A             STOPPED		N/A
+   cortex xdr    N/A          N/A             STOPPED		N/A
+   kproc-ctrl    N/A          N/A            Unloaded		N/A
+
+<strong>cytool runtime start all
+</strong>         Name    PID         User              Status		Command
+system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768
+   authorized   1883  _traps_panw             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/authorized
+          pmd   1889         root             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd
+   cortex xdr    N/A          N/A     FAILED TO START		N/A
+   kproc-ctrl    160         root              Loaded		com.paloaltonetworks.driver.kproc-ctrl
+</code></pre></td></tr><tr><td>scan</td><td><p>Perform Scan operations on the endpoint.</p><p>Options: <code>start</code>, <code>stop</code>, <code>query</code></p></td></tr><tr><td>startup</td><td><p>Enable, disable, or query the startup state of Cortex XDR agent components.</p><p>Usage: <code>cytool startup </code><em><code>&#x3C;action></code></em> <em><code>&#x3C;component></code></em></p><p>where:</p><ul><li><p>&#x3C;action>—Change startup action for an agent component.</p><p>Options are: <code>enable</code>, <code>disable</code>, <code>query</code>.</p><p>The query option displays the startup status for each component.</p></li><li>&#x3C;component>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: <code>cortex xdr</code>, <code>authorized</code>, <code>pmd</code>, <code>kproc-ctrl</code> </li></ul><p></p><p>For example:</p><pre><code><strong>root@ubuntu: sudo ./cytool startup disable cortex xdr pmd
+</strong>                  Process name                Startup status
+                    cortex xdr                      Disabled
+                    authorized                      Enabled
+                           pmd                      Disabled
+                    kproc-ctrl                      Loaded
+<strong>root@ubuntu: sudo ./cytool startup enable all
+</strong>                  Process name                Startup status
+                    cortex xdr                      Enabled
+                    authorized                      Enabled
+                           pmd                      Enabled
+                    kproc-ctrl                      Loaded
+</code></pre><p></p></td></tr></tbody></table>

▸ Troubleshooting Resources for Mac modified +1 −6 agent/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,9 @@

---

description: >-

Refer to the following troubleshooting resources for the Cortex XDR agent for

Mac.

---

# Troubleshooting Resources for Mac

Resource│Description


Resource	Description
Processes	Launch Daemons: `/Applications/Cortex XDR.app/Contents/MacOS/Cortex XDR` `/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd` `/Library/Application Support/PaloAltoNetworks/Traps/bin/authorized` Launch Agents: `/Library/Application Support/PaloAltoNetworks/Traps/bin/Cortex XDR Agent.app/Contents/MacOS/Cortex XDR Agent` System Extensions: `com.paloaltonetworks.traps.securityextension` `com.paloaltonetworks.traps.networkextension` Payload: `/Library/Application Support/PaloAltoNetworks/Traps/download/content/cortex-xdr-payload`
Cortex XDR agent console log	Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint: Mac OS X 10.10 and OSX 10.11—`/var/log/traps/agent/` macOS 10.12 and later releases—View logs from the Console application in `/Library/Logs/PaloAltoNetworks/Cortex XDR/`.
Cortex XDR agent service log	Indicates information, warnings, and errors related to Cortex XDR. The Service log is located in the following folder on the endpoint: Mac OS X 10.10 and OSX 10.11—`/var/log/traps/` macOS 10.12 and later releases—View logs from the Console application in `/Library/Logs/PaloAltoNetworks/Cortex XDR/`.
Supervisor Command Line Tool (cytool)	Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Mac.

| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Processes│

Launch Daemons:

/Applications/Cortex XDR.app/Contents/MacOS/Cortex XDR
/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd
/Library/Application Support/PaloAltoNetworks/Traps/bin/authorized

Launch Agents:

/Library/Application Support/PaloAltoNetworks/Traps/bin/Cortex XDR Agent.app/Contents/MacOS/Cortex XDR Agent

System Extensions:

com.paloaltonetworks.traps.securityextension
com.paloaltonetworks.traps.networkextension

Cortex XDR agent console log│

Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint:

Mac OS X 10.10 and OSX 10.11—/var/log/traps/agent/
macOS 10.12 and later releases—View logs from the Console application in /Library/Logs/PaloAltoNetworks/Cortex XDR/.

Cortex XDR agent service log│

Indicates information, warnings, and errors related to Cortex XDR. The Service log is located in the following folder on the endpoint:

Mac OS X 10.10 and OSX 10.11—/var/log/traps/
macOS 10.12 and later releases—View logs from the Console application in /Library/Logs/PaloAltoNetworks/Cortex XDR/.

Supervisor Command Line Tool (cytool)│Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Mac.

Show markdown source

@@ -1,14 +1,9 @@
 ---
 description: >-
   Refer to the following troubleshooting resources for the Cortex XDR agent for
   Mac.
 ---
 
 # Troubleshooting Resources for Mac
 
-| Resource                              | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Processes                             | <p>Launch Daemons:</p><ul><li><code>/Applications/Cortex XDR.app/Contents/MacOS/Cortex XDR</code></li><li><code>/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd</code></li><li><code>/Library/Application Support/PaloAltoNetworks/Traps/bin/authorized</code></li></ul><p>Launch Agents:</p><ul><li><code>/Library/Application Support/PaloAltoNetworks/Traps/bin/Cortex XDR Agent.app/Contents/MacOS/Cortex XDR Agent</code></li></ul><p>System Extensions:</p><ul><li><code>com.paloaltonetworks.traps.securityextension</code></li><li><code>com.paloaltonetworks.traps.networkextension</code></li></ul> |
-| Cortex XDR agent console log          | <p>Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint:</p><ul><li>Mac OS X 10.10 and OSX 10.11—<code>/var/log/traps/agent/</code></li><li>macOS 10.12 and later releases—View logs from the Console application in <code>/Library/Logs/PaloAltoNetworks/Cortex XDR/</code>.</li></ul>                                                                                                                                                                                                                                           |
-| Cortex XDR agent service log          | <p>Indicates information, warnings, and errors related to Cortex XDR. The Service log is located in the following folder on the endpoint:</p><ul><li>Mac OS X 10.10 and OSX 10.11—<code>/var/log/traps/</code></li><li>macOS 10.12 and later releases—View logs from the Console application in <code>/Library/Logs/PaloAltoNetworks/Cortex XDR/</code>.</li></ul>                                                                                                                                                                                                                                                        |
-| Supervisor Command Line Tool (cytool) | Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see [Cytool for Mac](troubleshooting-resources-for-mac/cytool-for-mac).                                                                                                                                                                                                                                                                                                                                                                                               |
+<table data-header-hidden><thead><tr><th width="160.15020751953125"></th><th width="590.1849365234375"></th></tr></thead><tbody><tr><td>Resource</td><td>Description</td></tr><tr><td>Processes</td><td><p>Launch Daemons:</p><ul><li><code>/Applications/Cortex XDR.app/Contents/MacOS/Cortex XDR</code></li><li><code>/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd</code></li><li><code>/Library/Application Support/PaloAltoNetworks/Traps/bin/authorized</code></li></ul><p>Launch Agents:</p><ul><li><code>/Library/Application Support/PaloAltoNetworks/Traps/bin/Cortex XDR Agent.app/Contents/MacOS/Cortex XDR Agent</code></li></ul><p>System Extensions:</p><ul><li><code>com.paloaltonetworks.traps.securityextension</code></li><li><code>com.paloaltonetworks.traps.networkextension</code> </li></ul><p>Payload:</p><ul><li><code>/Library/Application Support/PaloAltoNetworks/Traps/download/content/cortex-xdr-payload</code></li></ul></td></tr><tr><td>Cortex XDR agent console log</td><td><p>Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint:</p><ul><li>Mac OS X 10.10 and OSX 10.11—<code>/var/log/traps/agent/</code></li><li>macOS 10.12 and later releases—View logs from the Console application in <code>/Library/Logs/PaloAltoNetworks/Cortex XDR/</code>.</li></ul></td></tr><tr><td>Cortex XDR agent service log</td><td><p>Indicates information, warnings, and errors related to Cortex XDR. The Service log is located in the following folder on the endpoint:</p><ul><li>Mac OS X 10.10 and OSX 10.11—<code>/var/log/traps/</code></li><li>macOS 10.12 and later releases—View logs from the Console application in <code>/Library/Logs/PaloAltoNetworks/Cortex XDR/</code>.</li></ul></td></tr><tr><td>Supervisor Command Line Tool (cytool)</td><td>Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see <a href="troubleshooting-resources-for-mac/cytool-for-mac">Cytool for Mac</a>.</td></tr></tbody></table>

▸ Cytool for Mac modified +72 −1 The Cytool options table gained the full usage listing plus output examples for dump, enum, opswat, runtime, startup and wakeup. agent/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac/cytool-for-mac

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -13,9 +13,80 @@ On Mac endpoints, access Cytool as a super user using a terminal. Cytool is loca

The following table displays the Cytool options available on Mac endpoints. For the Cytool admin commands that require a password, the password is the same as is defined as the Uninstall password.

hint info

### Note

Since Cortex XDR agent 7.6, the pmd process includes and replaces the trapsd process.

endhint


Command Option	Description
`cert_enforcement`	Perform Certificate enforcement related operations. Usage: `cytool cert_enforcement <operation>` Where <operation> is one of the following: query Display current enforcement status disable Forcibly disable enforcement policy Set enforcement by policy import <certificate file path> Import a proprietary certificate in PEM format as root CA import clear Clear all custom root CA certificates.
`checkin`	Initiate check-in to the server. Usage: `sudo ./cytool checkin` To verify the checkin, view the check-in time on the Cortex XDR agent console.
`connectivity_test`	Perform a connectivity test to Cortex XDR servers. Usage: `cytool connectivity_test [request_count]`
`dump`	Enable or disable dump generation or restore policy settings. `Traps-Mac:bin Traps$` `sudo ./cytool dump enable``Traps-Mac:bin Traps$``sudo ./cytool dump disable``Traps-Mac:bin Traps$``sudo ./cytool dump restore`
`endpoint_tags`	Usage: `sudo ./cytool endpoint_tags` `<action>` where `<action>` can be: `add`—To add tags to the endpoint tags. `remove`—Remove the given tags from the list of endpoint tags. `list`—Displays the available endpoint tags. Note Tags should be passed as one string separated by comas. For example: `Traps-Mac:bin Traps$` `sudo ./cytool endpoint_tags add "tag1 [,tag2, ...,tagN]"` `Traps-Mac:bin Traps$` `sudo ./cytool endpoint_tags remove "tag1 [,tag2, ...,tagN]"` `Traps-Mac:bin Traps$` `sudo ./cytool endpoint_tags list`
`enum`	Enumerate protected processes. Usage: `sudo ./cytool enum` For example: `Traps-Mac:bin Traps$` `sudo ./cytool enum` `List of protected processes: Process name Process ID User Photos 2047 User1 Mail 2099 User2` Note If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.
`-h --help`	`Traps-Mac:bin Traps$` `sudo ./cytool`` Usage: cytool cytool - Support tool Options: -h --help Display help information. enum List processes protected by Cortex XDR. startup query List startup status for Cortex XDR agent and daemons. startup <enable
`import suex`	Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.
isolate	Usage: `cytool isolate stop` Release endpoint from network isolation.
log	`Log set_level` - Set the log level for the desired process. Usage: `sudo ./cytool log set_level <log_level> <components>` where: `<log_level>` is an integer value corresponding to the log level: 0—Disable logging 1—Fatal 2—Critical 3—Error 4—Warning 5—Notice 6—Information 7—Debug 8—Trace `<components>` is `all` or one or more of the following agent component: `authorized`, `pmd`, `cortex xdr`, `kproc-ctrl`. For example: `Traps-Mac:bin Traps$` `sudo ./cytool log set_level 2 all` `log collect` Use the `sudo ./cytool log collect` command to generate a support file archive of all logs in a TGZ file. On Mac endpoints running OS X 10.10 and OSX 10.11, Cytool outputs the logs to the `/var/log/traps` directory. On Mac endpoints running macOS 10.12 and later, you can view logs from the Console application.
`opswat`	Check the Cortex XDR agent status and version. Usage: `sudo ./cytool opswat <parameter>` where `<parameter>` is: `version`—Displays the version of the agent. `installed`—Displays the agent installation status: `true` if the com.paloaltonetworks.pkg.cortx xdr package is installed or `false` if the package is not installed. You must also supply the agent supervisor password to view the status. `running`—Displays the running status of agent daemons: true if running or false if not running. `protected`—Displays the applied policy status: true if applied or false if not applied. `Traps-Mac:bin Traps$` `sudo ./cytool opswat version``8.1.0.1042 Traps-Mac:bin Traps$``sudo ./cytool opswat installed``Password: true Traps-Mac:bin Traps$``sudo ./cytool opswat running``true Traps-Mac:bin Traps$``sudo ./cytool opswat protected` `true`
`persist`	The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database. Usage: `sudo ./cytool persist` `<action>` where `<action>`: `list`—List the local databases on the endpoint. *`export` `[<database name>`*`
`queryall`	The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.
`Reconnect`	Try reconnecting to the server if communication has been disabled, or force registration with a new `distribution_id`. Usage: `cytool reconnect`—Reconnects the Cortex XDR agent to the management application on the server. `cytool reconnect [force <distribution_id]>` Note The `distribution_id` must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.
`runtime`	Stop or start product components. Usage: `sudo ./cytool runtime` `<action>` `<component>` where: `<action>`—Change startup runtime action for an agent component. Options are: `start`, `stop`, `query`. The query option displays the startup status for each component. `<component>`—Target component for which to set the runtime action, or all components if no components are specified. To change the runtime action for multiple components, list them with spaces separating each component. Options are: `cortex xdr`, `authorized`, `pmd`, `kproc-ctrl` For example: `Traps-Mac:bin Traps$` `sudo ./cytool runtime query``Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl Traps-Mac:bin Traps$``sudo ./cytool runtime stop all``Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A Traps-Mac:bin Traps$``sudo ./cytool runtime start all` `Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl`
`security_modules`	Query, enable, disable or return to policy the Cortex XDR agent anti-tampering protection. Usage: `cytool security_modules operation module` Where: Operation is one of the following: `query` — Queries Security Module activity status `enable`— Enables Security Module `disable`— Disables Security Module `policy`— Syncs the Security Module according to cloud-defined policy Module options self_prot \| proc_ctrl \| event_collection \| dlprot \| kpep \| dlp \| all Example: To disable the Cortex XDR agent anti-tampering protection: `cytool security_modules disable self_prot`
`startup`	Enable, disable, or query the startup state of Cortex XDR agent components. Usage: `sudo ./cytool startup` `<action>` `<component>` where: `<action>`—Change startup action for an agent component. Options are: `enable`, `disable`, `query`. The query option displays the startup status for each component. `<component>`—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: `cortex xdr`, `authorized`, `pmd`, `kproc-ctrl` For example: `Traps-Mac:bin Traps$` `sudo ./cytool startup disable cortex xdr pmd``Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded Traps-Mac:bin Traps$``sudo ./cytool startup enable all``Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded`
`wakeup`	Wake up the endpoint from an OS incompatibility state. `Traps-Mac:bin Traps$` `sudo ./cytool wakeup SIGTERM caught`


Command Option	Description
cert_enforcement	Perform Certificate enforcement related operations. Usage: `cytool cert_enforcement <operation>` Where <operation> is one of the following: `query` —Displays current enforcement status `disable` —Forcibly disables enforcement `policy`—Sets enforcement by policy `import <certificate file path>`—Imports a proprietary certificate in PEM format as root CA `import clear`—Clears all custom root CA certificates.
checkin	Initiate check-in to the server. Usage: `sudo ./cytool checkin` To verify the checkin, view the check-in time on the Cortex XDR agent console.
connectivity_test	Perform a connectivity test to Cortex XDR servers. Usage: `cytool connectivity_test [request_count]`
dump	Enable or disable dump generation or restore policy settings. `Traps-Mac:bin Traps$ sudo ./cytool dump enable`

Traps-Mac:bin Traps$ sudo ./cytool dump disable

Traps-Mac:bin Traps$ sudo ./cytool dump restore

</code></pre></td></tr><tr><td>endpoint_tags</td><td>Use Endpoint Tags to identify groups of endpoints.Usage: sudo ./cytool endpoint_tags <action>where <action> can be:<ul><li>add—Adds tags to the endpoint tags.</li><li>remove—Removes the given tags from the list of endpoint tags.</li><li>list—Displays the available endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info">NoteTags should be passed as one string separated by comas.</div>For example:<ul><li>Traps-Mac:bin Traps$ sudo ./cytool endpoint_tags add "tag1[,tag2,...,tagN]"</li><li>Traps-Mac:bin Traps$ sudo ./cytool endpoint_tags remove "tag1[,tag2,...,tagN]"</li><li>Traps-Mac:bin Traps$ sudo ./cytool endpoint_tags list</li></ul></td></tr><tr><td>enum</td><td>Enumerate protected processes.Usage: sudo ./cytool enumFor example:<pre>Traps-Mac:bin Traps$ sudo ./cytool enum

List of protected processes:

Process name Process ID User

Photos 2047 User1

Mail 2099 User2

</code></pre>Note<div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info">If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.</div></td></tr><tr><td>-h --help</td><td><pre>Traps-Mac:bin Traps$ sudo ./cytool

Usage: cytool<options>

cytool - Support tool

Options:

-h --help Display help information.

enum List processes protected by Cortex XDR.

startup query List startup status for Cortex XDR agent and daemons.

startup <enable

disable> <process_name

all> Enable/Disable Cortex XDR agent and daemons after reboot.

runtime query List runtime status for agent, daemons, and kernel extensions.

runtime <start

stop> <process_name

all> Start/Stop Cortex XDR agent, daemons, and kernel extensions immediately.

persist list Display persistent databases.

persist export <db_name

db_path> Export databases in JSON format.

persist import <db_name

db_path> <file_name> Import data into the database from the given JSON file.

persist print <db_name

db_path> [csv] Print database to the command prompt.

log <log_level> <process_name

all> Set log level for the desired process.

log collect Generate support file archive.

wakeup Wake up from OS incompatibility state.

dump <enable

disable

restore> Enable/Disable dump generation or restore policy settings.

checkin Update Cortex XDR from server.

opswat <installed

running

protected

version> Check Cortex XDR Agent status and version.

</code></pre></td></tr><tr><td>import suex</td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>isolate</td><td>Usage: cytool isolate stopRelease endpoint from network isolation.</td></tr><tr><td>log</td><td>Log set_level - Set the log level for the desired process.Usage: sudo ./cytool log set_level <log_level> <components>where:<ul><li><log_level> is an integer value corresponding to the log level:<ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li><components> is all or one or more of the following agent component: authorized, pmd, cortex xdr, kproc-ctrl.</li></ul>For example:<pre>Traps-Mac:bin Traps$ sudo ./cytool log set_level 2 all

</code></pre>log collect Use the sudo ./cytool log collect command to generate a support file archive of all logs in a TGZ file. On Mac endpoints running OS X 10.10 and OSX 10.11, Cytool outputs the logs to the /var/log/traps directory. On Mac endpoints running macOS 10.12 and later, you can view logs from the Console application.</td></tr><tr><td>opswat</td><td>Check the Cortex XDR agent status and version.Usage: sudo ./cytool opswat <parameter>where <parameter> is:<ul><li>version—Displays the version of the agent.</li><li>installed—Displays the agent installation status:<ul><li>true if the com.paloaltonetworks.pkg.cortx xdr package is installed.</li><li>false if the package is not installed.You must also supply the agent supervisor password to view the status.</li></ul></li><li>running—Displays the running status of agent daemons: true if running or false if not running.</li><li>protected—Displays the applied policy status: true if applied or false if not applied.</li></ul><pre>Traps-Mac:bin Traps$ sudo ./cytool opswat version

8.1.0.1042

Traps-Mac:bin Traps$ sudo ./cytool opswat installed

Password:

true

Traps-Mac:bin Traps$ sudo ./cytool opswat running

true

Traps-Mac:bin Traps$ sudo ./cytool opswat protected

true

</code></pre></td></tr><tr><td>persist</td><td>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.
Usage: sudo ./cytool persist <action>where <action>:<ul><li>list—List the local databases on the endpoint.</li><li>export [<database name> | <databasepath>]—Export database table to a file in the /Library/Application Support/PaloAltoNetworks/Traps/bin/ directory.</li><li>import [<database name> | <databasepath>] <file name>—Add records in a JSON file to the database.</li><li>print <database name> | <databasepath>—Print the database, in comma-separated values (CSV) format, to the command prompt.</li></ul>To view a list of all local databases, use the cytool persist list command.</td></tr><tr><td>queryall</td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td>reconnect</td><td>Try reconnecting to the server if communication has been disabled, or force registration with a new distribution_id.Usage:<ul><li>cytool reconnect—Reconnects the Cortex XDR agent to the management application on the server.</li><li>cytool reconnect [force <distribution_id>]</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info">NoteThe distribution_id must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</div></td></tr><tr><td>runtime</td><td>Stop or start product components.Usage: sudo ./cytool runtime <action> <component>where:<ul><li><action>—Change startup runtime action for an agent component.Options are: start, stop, query. The query option displays the startup status for each component.</li><li><component>—Target component for which to set the runtime action, or all components if no components are specified.To change the runtime action for multiple components, list them with spaces separating each component.Options are: cortex xdr, authorized, pmd, kproc-ctrl </li></ul>For example:<pre>Traps-Mac:bin Traps$ sudo ./cytool runtime query

Name PID User Status Command

cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr

authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized

pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd

kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl

Traps-Mac:bin Traps$ sudo ./cytool runtime stop all

Name PID User Status Command

authorized N/A N/A STOPPED N/A

pmd N/A N/A STOPPED N/A

cortex xdr N/A N/A STOPPED N/A

kproc-ctrl N/A N/A Unloaded N/A

Traps-Mac:bin Traps$ sudo ./cytool runtime start all

Name PID User Status Command

system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768

authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized

pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd

cortex xdr N/A N/A FAILED TO START N/A

kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl

</code></pre></td></tr><tr><td>security_modules</td><td>Query, enable, disable or return to policy the Cortex XDR agent anti-tampering protection.Usage: cytool security_modules operation moduleWhere:<ul><li>Operation is one of the following:<ul><li>query — Queries Security Module activity status</li><li>enable— Enables Security Module</li><li>disable— Disables Security Module</li><li>policy— Syncs the Security Module according to cloud-defined policy</li></ul></li><li>Module options self_prot proc_ctrl event_collection dlprot kpep dlp all</li></ul>Example: To disable the Cortex XDR agent anti-tampering protection:cytool security_modules disable self_prot</td></tr><tr><td>startup</td><td>Enable, disable, or query the startup state of Cortex XDR agent components.Usage: sudo ./cytool startup <action> <component>where:<ul><li><action>—Change startup action for an agent component.Options are: enable, disable, query.The query option displays the startup status for each component.</li><li><component>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: cortex xdr, authorized, pmd, kproc-ctrl</li></ul>For example:<pre>Traps-Mac:bin Traps$ sudo ./cytool startup disable cortex xdr pmd

Process name Startup status

cortex xdr Disabled

authorized Enabled

pmd Disabled

kproc-ctrl Loaded

Traps-Mac:bin Traps$ sudo ./cytool startup enable all

Process name Startup status

cortex xdr Enabled

authorized Enabled

pmd Enabled

kproc-ctrl Loaded

</code></pre></td></tr><tr><td>wakeup</td><td>Wake up the endpoint from an OS incompatibility state.Traps-Mac:bin Traps$ sudo ./cytool wakeup SIGTERM caught</td></tr></tbody></table>

Show markdown source

@@ -13,9 +13,80 @@ On Mac endpoints, access Cytool as a super user using a terminal. Cytool is loca
 The following table displays the Cytool options available on Mac endpoints. For the Cytool admin commands that require a password, the password is the same as is defined as the Uninstall password.
 
 {% hint style="info" %}
 ### Note
 
 Since Cortex XDR agent 7.6, the `pmd` process includes and replaces the `trapsd` process.
 {% endhint %}
 
-<table data-header-hidden><thead><tr><th width="212.9400634765625"></th><th></th></tr></thead><tbody><tr><td>Command Option</td><td>Description</td></tr><tr><td><code>cert_enforcement</code></td><td><p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li>query                       Display current enforcement status</li><li>disable                     Forcibly disable enforcement</li><li>policy                      Set enforcement by policy</li><li>import &#x3C;certificate file path>     Import a proprietary certificate in PEM format as root CA</li><li>import clear                       Clear all custom root CA certificates.</li></ul></td></tr><tr><td><code>checkin</code></td><td><p>Initiate check-in to the server.</p><p>Usage: <strong><code>sudo ./cytool checkin</code></strong></p><p>To verify the checkin, view the check-in time on the Cortex XDR agent console.</p></td></tr><tr><td><code>connectivity_test</code></td><td><p>Perform a connectivity test to Cortex XDR servers.</p><p>Usage: <code>cytool connectivity_test [request_count]</code></p></td></tr><tr><td><code>dump</code></td><td><p>Enable or disable dump generation or restore policy settings.</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool dump enable</code></strong><code>Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool dump disable</code></strong><code>Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool dump restore</code></strong></p></td></tr><tr><td><code>endpoint_tags</code></td><td><p>Usage: <strong><code>sudo ./cytool endpoint_tags </code></strong><em><strong><code>&#x3C;action></code></strong></em></p><p>where <em><strong><code>&#x3C;action></code></strong></em> can be:</p><ul><li><strong><code>add</code></strong>—To add tags to the endpoint tags.</li><li><strong><code>remove</code></strong>—Remove the given tags from the list of endpoint tags.</li><li><strong><code>list</code></strong>—Displays the available endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string separated by comas.</p></div><p>For example:</p><ul><li><p><code>Traps-Mac:bin Traps$</code></p><p><strong><code>sudo ./cytool endpoint_tags add "tag1 [,tag2, ...,tagN]"</code></strong></p></li><li><p><code>Traps-Mac:bin Traps$</code></p><p><strong><code>sudo ./cytool endpoint_tags remove "tag1 [,tag2, ...,tagN]"</code></strong></p></li><li><p><code>Traps-Mac:bin Traps$</code></p><p><strong><code>sudo ./cytool endpoint_tags list</code></strong></p></li></ul></td></tr><tr><td><code>enum</code></td><td><p>Enumerate protected processes.</p><p>Usage: <strong><code>sudo ./cytool enum</code></strong></p><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool enum</code></strong><code> List of protected processes: Process name Process ID User Photos 2047 User1 Mail 2099 User2</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.</p></div></td></tr><tr><td><code>-h --help</code></td><td><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool</code></strong>` Usage: cytool cytool - Support tool Options: -h --help Display help information. enum List processes protected by Cortex XDR. startup query List startup status for Cortex XDR agent and daemons. startup &#x3C;enable</td></tr><tr><td><code>import suex</code></td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>isolate</td><td><p>Usage: <code>cytool isolate stop</code></p><p>Release endpoint from network isolation.</p></td></tr><tr><td>log</td><td><p><code>Log set_level</code> - Set the log level for the desired process.</p><p>Usage: <code>sudo ./cytool log set_level &#x3C;log_level> &#x3C;components></code></p><p>where:</p><ul><li><p><code>&#x3C;log_level></code> is an integer value corresponding to the log level:</p><ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li><code>&#x3C;components></code> is <strong><code>all</code></strong> or one or more of the following agent component: <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>cortex xdr</code></strong>, <strong><code>kproc-ctrl</code></strong>.</li></ul><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool log set_level 2 all</code></strong></p><p><code>log collect</code></p><p>Use the <strong><code>sudo ./cytool log collect</code></strong> command to generate a support file archive of all logs in a TGZ file. On Mac endpoints running OS X 10.10 and OSX 10.11, Cytool outputs the logs to the <code>/var/log/traps</code> directory. On Mac endpoints running macOS 10.12 and later, you can view logs from the Console application.</p></td></tr><tr><td><code>opswat</code></td><td><p>Check the Cortex XDR agent status and version.</p><p>Usage: <strong><code>sudo ./cytool opswat &#x3C;parameter></code></strong></p><p>where <strong><code>&#x3C;parameter></code></strong> is:</p><ul><li><strong><code>version</code></strong>—Displays the version of the agent.</li><li><p><strong><code>installed</code></strong>—Displays the agent installation status:</p><p><code>true</code> if the com.paloaltonetworks.pkg.cortx xdr package is installed</p><p>or <code>false</code> if the package is not installed.</p><p>You must also supply the agent supervisor password to view the status.</p></li><li><strong><code>running</code></strong>—Displays the running status of agent daemons: true if running or false if not running.</li><li><strong><code>protected</code></strong>—Displays the applied policy status: true if applied or false if not applied.</li></ul><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool opswat version</code></strong><code>8.1.0.1042 Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool opswat installed</code></strong><code>Password: true Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool opswat running</code></strong><code>true Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool opswat protected</code></strong><code> true</code></p></td></tr><tr><td><code>persist</code></td><td><p>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <strong><code>sudo ./cytool persist </code></strong><em><strong><code>&#x3C;action></code></strong></em></p><p>where <em><strong><code>&#x3C;action></code></strong></em>:</p><ul><li><strong><code>list</code></strong>—List the local databases on the endpoint.</li><li>**<code>export </code><em><code>[&#x3C;database name></code></em>`</li></ul></td></tr><tr><td><code>queryall</code></td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td><code>Reconnect</code></td><td><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div></td></tr><tr><td><code>runtime</code></td><td><p>Stop or start product components.</p><p>Usage: <strong><code>sudo ./cytool runtime </code></strong><em><strong><code>&#x3C;action></code></strong></em> <em><strong><code>&#x3C;component></code></strong></em></p><p>where:</p><ul><li><p><em><strong><code>&#x3C;action></code></strong></em>—Change startup runtime action for an agent component.</p><p>Options are: <strong><code>start</code></strong>, <strong><code>stop</code></strong>, <strong><code>query</code></strong>. The query option displays the startup status for each component.</p></li><li><p><em><strong><code>&#x3C;component></code></strong></em>—Target component for which to set the runtime action, or all components if no components are specified.</p><p>To change the runtime action for multiple components, list them with spaces separating each component.</p><p>Options are: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></p></li></ul><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool runtime query</code></strong><code>Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool runtime stop all</code></strong><code>Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool runtime start all</code></strong><code> Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl</code></p></td></tr><tr><td><code>security_modules</code></td><td><p>Query, enable, disable or return to policy the Cortex XDR agent anti-tampering protection.</p><p>Usage: <strong><code>cytool security_modules operation module</code></strong></p><p>Where:</p><ul><li><p>Operation is one of the following:</p><ul><li><strong><code>query</code></strong> — Queries Security Module activity status</li><li><strong><code>enable</code></strong>— Enables Security Module</li><li><strong><code>disable</code></strong>— Disables Security Module</li><li><strong><code>policy</code></strong>— Syncs the Security Module according to cloud-defined policy</li></ul></li><li>Module options self_prot | proc_ctrl | event_collection | dlprot | kpep | dlp | all</li></ul><p>Example: To disable the Cortex XDR agent anti-tampering protection:</p><p><strong><code>cytool security_modules disable self_prot</code></strong></p></td></tr><tr><td><code>startup</code></td><td><p>Enable, disable, or query the startup state of Cortex XDR agent components.</p><p>Usage: <strong><code>sudo ./cytool startup </code></strong><em><strong><code>&#x3C;action></code></strong></em> <em><strong><code>&#x3C;component></code></strong></em></p><p>where:</p><ul><li><p><em><strong><code>&#x3C;action></code></strong></em>—Change startup action for an agent component.</p><p>Options are: <strong><code>enable</code></strong>, <strong><code>disable</code></strong>, <strong><code>query</code></strong>.</p><p>The query option displays the startup status for each component.</p></li><li><em><strong><code>&#x3C;component></code></strong></em>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></li></ul><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool startup disable cortex xdr pmd</code></strong><code>Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool startup enable all</code></strong><code>Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded</code></p></td></tr><tr><td><code>wakeup</code></td><td><p>Wake up the endpoint from an OS incompatibility state.</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool wakeup SIGTERM caught</code></strong></p></td></tr></tbody></table>
+<table data-header-hidden><thead><tr><th width="212.9400634765625"></th><th width="535.0599365234375"></th></tr></thead><tbody><tr><td>Command Option</td><td>Description</td></tr><tr><td>cert_enforcement</td><td><p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li><code>query</code> —Displays current enforcement status</li><li><code>disable</code> —Forcibly disables enforcement</li><li><code>policy</code>—Sets enforcement by policy</li><li><code>import &#x3C;certificate file path></code>—Imports a proprietary certificate in PEM format as root CA</li><li><code>import clear</code>—Clears all custom root CA certificates.</li></ul></td></tr><tr><td>checkin</td><td><p>Initiate check-in to the server.</p><p>Usage: <code>sudo ./cytool checkin</code></p><p>To verify the checkin, view the check-in time on the Cortex XDR agent console.</p></td></tr><tr><td>connectivity_test</td><td><p>Perform a connectivity test to Cortex XDR servers.</p><p>Usage: <code>cytool connectivity_test [request_count]</code></p></td></tr><tr><td>dump</td><td><p></p><p>Enable or disable dump generation or restore policy settings.</p><pre><code><strong>Traps-Mac:bin Traps$ sudo ./cytool dump enable
+</strong><strong>Traps-Mac:bin Traps$ sudo ./cytool dump disable
+</strong><strong>Traps-Mac:bin Traps$ sudo ./cytool dump restore
+</strong></code></pre></td></tr><tr><td>endpoint_tags</td><td><p>Use Endpoint Tags to identify groups of endpoints.</p><p>Usage: <code>sudo ./cytool endpoint_tags </code><em><code>&#x3C;action></code></em></p><p>where <em><code>&#x3C;action></code></em> can be:</p><ul><li><code>add</code>—Adds tags to the endpoint tags.</li><li><code>remove</code>—Removes the given tags from the list of endpoint tags.</li><li><code>list</code>—Displays the available endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string separated by comas.</p></div><p>For example:</p><ul><li><code>Traps-Mac:bin Traps$   sudo ./cytool endpoint_tags add "tag1[,tag2,...,tagN]"</code></li><li><code>Traps-Mac:bin Traps$   sudo ./cytool endpoint_tags remove "tag1[,tag2,...,tagN]"</code></li><li><code>Traps-Mac:bin Traps$   sudo ./cytool endpoint_tags list</code></li></ul></td></tr><tr><td>enum</td><td><p>Enumerate protected processes.</p><p>Usage: <code>sudo ./cytool enum</code></p><p></p><p>For example:</p><pre><code><strong>Traps-Mac:bin Traps$ sudo ./cytool enum
+</strong>List of protected processes:
+        Process name          Process ID             User
+              Photos                2047            User1
+                Mail                2099            User2
+</code></pre><p><strong>Note</strong></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.</p></div></td></tr><tr><td>-h --help</td><td><p></p><pre><code>Traps-Mac:bin Traps$ sudo ./cytool
+
+Usage: cytool&#x3C;options>
+cytool - Support tool
+
+Options:
+-h --help                                           Display help information.
+enum                                                List processes protected by Cortex XDR.
+startup query                                       List startup status for Cortex XDR agent and daemons.
+startup &#x3C;enable | disable> &#x3C;process_name | all>     Enable/Disable Cortex XDR agent and daemons after reboot.
+runtime query                                       List runtime status for agent, daemons, and kernel extensions.
+runtime &#x3C;start | stop> &#x3C;process_name | all>         Start/Stop Cortex XDR agent, daemons, and kernel extensions immediately.
+persist list                                        Display persistent databases.
+persist export &#x3C;db_name | db_path>                  Export databases in JSON format.
+persist import &#x3C;db_name | db_path> &#x3C;file_name>      Import data into the database from the given JSON file.
+persist print &#x3C;db_name | db_path> [csv]             Print database to the command prompt.
+log &#x3C;log_level> &#x3C;process_name | all>                Set log level for the desired process.
+log collect                                         Generate support file archive.
+wakeup                                              Wake up from OS incompatibility state.
+dump &#x3C;enable | disable | restore>                   Enable/Disable dump generation or restore policy settings.
+checkin                                             Update Cortex XDR from server.
+opswat &#x3C;installed | running | protected | version>  Check Cortex XDR Agent status and version. 
+</code></pre></td></tr><tr><td>import suex</td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>isolate</td><td><p>Usage: <code>cytool isolate stop</code></p><p>Release endpoint from network isolation.</p></td></tr><tr><td>log</td><td><p><code>Log set_level</code> - Set the log level for the desired process.</p><p>Usage: <code>sudo ./cytool log set_level &#x3C;log_level> &#x3C;components></code></p><p>where:</p><ul><li><p>&#x3C;log_level> is an integer value corresponding to the log level:</p><ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li>&#x3C;components> is <code>all</code> or one or more of the following agent component: <code>authorized</code>, <code>pmd</code>, <code>cortex xdr</code>, <code>kproc-ctrl</code>.</li></ul><p>For example:</p><pre><code>Traps-Mac:bin Traps$ sudo ./cytool log set_level 2 all
+</code></pre><p></p><p><code>log collect</code> </p><p>Use the <code>sudo ./cytool log collect</code> command to generate a support file archive of all logs in a TGZ file. On Mac endpoints running OS X 10.10 and OSX 10.11, Cytool outputs the logs to the <code>/var/log/traps</code> directory. On Mac endpoints running macOS 10.12 and later, you can view logs from the Console application.</p></td></tr><tr><td>opswat</td><td><p>Check the Cortex XDR agent status and version.</p><p>Usage: <code>sudo ./cytool opswat &#x3C;parameter></code></p><p>where &#x3C;parameter> is:</p><ul><li><code>version</code>—Displays the version of the agent.</li><li><p><code>installed</code>—Displays the agent installation status:</p><ul><li><code>true</code> if the com.paloaltonetworks.pkg.cortx xdr package is installed.</li><li><p><code>false</code> if the package is not installed.</p><p>You must also supply the agent supervisor password to view the status.</p></li></ul></li><li><code>running</code>—Displays the running status of agent daemons: true if running or false if not running.</li><li><code>protected</code>—Displays the applied policy status: true if applied or false if not applied.</li></ul><p></p><pre><code><strong>Traps-Mac:bin Traps$ sudo ./cytool opswat version
+</strong>8.1.0.1042
+<strong>Traps-Mac:bin Traps$ sudo ./cytool opswat installed
+</strong>Password:
+true
+<strong>Traps-Mac:bin Traps$ sudo ./cytool opswat running
+</strong>true
+<strong>Traps-Mac:bin Traps$ sudo ./cytool opswat protected
+</strong>true
+</code></pre></td></tr><tr><td>persist</td><td><p>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.<br></p><p>Usage: <code>sudo ./cytool persist &#x3C;</code><em><code>action></code></em></p><p>where <em>&#x3C;action></em>:</p><ul><li><code>list</code>—List the local databases on the endpoint.</li><li><code>export </code><em><code>[&#x3C;database name></code></em><code> | </code><em><code>&#x3C;databasepath>]</code></em>—Export database table to a file in the <code>/Library/Application Support/PaloAltoNetworks/Traps/bin/</code> directory.</li><li><code>import </code><em><code>[&#x3C;database name></code></em><code> | </code><em><code>&#x3C;databasepath></code></em><code>] &#x3C;file name></code>—Add records in a JSON file to the database.</li><li><code>print </code><em><code>&#x3C;database name></code></em><code> | </code><em><code>&#x3C;databasepath></code></em>—Print the database, in comma-separated values (CSV) format, to the command prompt.</li></ul><p>To view a list of all local databases, use the <code>cytool persist list</code> command.</p></td></tr><tr><td>queryall</td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td>reconnect</td><td><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id>]</code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div></td></tr><tr><td>runtime</td><td><p>Stop or start product components.</p><p>Usage: <code>sudo ./cytool runtime </code><em><code>&#x3C;action></code></em> <em><code>&#x3C;component></code></em></p><p>where:</p><ul><li><p><em>&#x3C;action></em>—Change startup runtime action for an agent component.</p><p>Options are: <code>start</code>, <code>stop</code>, <code>query</code>. The query option displays the startup status for each component.</p></li><li><p><em>&#x3C;component></em>—Target component for which to set the runtime action, or all components if no components are specified.</p><p>To change the runtime action for multiple components, list them with spaces separating each component.</p><p>Options are: <code>cortex xdr</code>, <code>authorized</code>, <code>pmd</code>, <code>kproc-ctrl</code> </p></li></ul><p></p><p>For example:</p><pre><code><strong>Traps-Mac:bin Traps$ sudo ./cytool runtime query
+</strong>         Name    PID         User              Status		Command
+  cortex xdr   1055        User1             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr
+   authorized    927  _traps_panw             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/authorized
+          pmd    909         root             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd
+   kproc-ctrl    159         root              Loaded		com.paloaltonetworks.driver.kproc-ctrl
+<strong>Traps-Mac:bin Traps$ sudo ./cytool runtime stop all
+</strong>         Name    PID         User              Status		Command
+   authorized    N/A          N/A             STOPPED		N/A
+          pmd    N/A          N/A             STOPPED		N/A
+  cortex xdr    N/A          N/A             STOPPED		N/A
+   kproc-ctrl    N/A          N/A            Unloaded		N/A
+<strong>Traps-Mac:bin Traps$ sudo ./cytool runtime start all
+</strong>         Name    PID         User              Status		Command
+system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768
+   authorized   1883  _traps_panw             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/authorized
+          pmd   1889         root             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd
+  cortex xdr    N/A          N/A     FAILED TO START		N/A
+   kproc-ctrl    160         root              Loaded		com.paloaltonetworks.driver.kproc-ctrl
+</code></pre></td></tr><tr><td>security_modules</td><td><p>Query, enable, disable or return to policy the Cortex XDR agent anti-tampering protection.</p><p>Usage: <code>cytool security_modules operation module</code></p><p>Where:</p><ul><li><p>Operation is one of the following:</p><ul><li><code>query</code> — Queries Security Module activity status</li><li><code>enable</code>— Enables Security Module</li><li><code>disable</code>— Disables Security Module</li><li><code>policy</code>— Syncs the Security Module according to cloud-defined policy</li></ul></li><li>Module options <code>self_prot</code> | <code>proc_ctrl</code> | <code>event_collection</code> | <code>dlprot</code> | <code>kpep</code> | <code>dlp</code> | <code>all</code></li></ul><p>Example: To disable the Cortex XDR agent anti-tampering protection:</p><p><code>cytool security_modules disable self_prot</code></p></td></tr><tr><td>startup</td><td><p>Enable, disable, or query the startup state of Cortex XDR agent components.</p><p>Usage: <code>sudo ./cytool startup </code><em><code>&#x3C;action></code></em> <em><code>&#x3C;component></code></em></p><p>where:</p><ul><li><p><em>&#x3C;action></em>—Change startup action for an agent component.</p><p>Options are: <code>enable</code>, <code>disable</code>, <code>query</code>.</p><p>The query option displays the startup status for each component.</p></li><li><em>&#x3C;component></em>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: <code>cortex xdr</code>, <code>authorized</code>, <code>pmd</code>, <code>kproc-ctrl</code></li></ul><p>For example:</p><pre><code><strong>Traps-Mac:bin Traps$ sudo ./cytool startup disable cortex xdr pmd
+</strong>                  Process name                Startup status
+                    cortex xdr                      Disabled
+                    authorized                      Enabled
+                           pmd                      Disabled
+                    kproc-ctrl                      Loaded
+<strong>Traps-Mac:bin Traps$ sudo ./cytool startup enable all
+</strong>                  Process name                Startup status
+                    cortex xdr                      Enabled
+                    authorized                      Enabled
+                           pmd                      Enabled
+                    kproc-ctrl                      Loaded
+</code></pre></td></tr><tr><td>wakeup</td><td><p>Wake up the endpoint from an OS incompatibility state.</p><p><code>Traps-Mac:bin Traps$  sudo ./cytool wakeup SIGTERM caught</code></p></td></tr></tbody></table>

▸ Troubleshooting resources for Windows modified +1 −1 agent/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,9 +1,9 @@

---

description: >-

Refer to the following troubleshooting resources for the Cortex XDR agent for

Windows.

---

# Troubleshooting resources for Windows


Resource	Description
Services, Drivers, and Processes	Services: `C:\Program Files\Palo Alto Networks\Traps\cyserver.exe` `C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\xdrhealth.exe` Drivers: `C:\Program Files\Palo Alto Networks\Traps\cyverak.sys` `C:\Program Files\Palo Alto Networks\Traps\cyvrmtgn.sys` `C:\Program Files\Palo Alto Networks\Traps\cyvrfsfd.sys` `C:\Program Files\Palo Alto Networks\Traps\tedrdrv.sys` `C:\Program Files\Palo Alto Networks\Traps\tdevflt.sys` `C:\Program Files\Palo Alto Networks\Traps\tedrpers-<version>.sys` `C:\Windows\System32\drivers\telam.sys` Processes: `C:\Program Files\Palo Alto Networks\Traps\CyveraConsole.exe` `C:\Program Files\Palo Alto Networks\Traps\tlaworker.exe` (background process that is always running) `C:\Program Files\Palo Alto Networks\Traps\cytray.exe` (background process that is always running) `C:\Program Files\Palo Alto Networks\Traps\cytool.exe` `C:\Program Files\Palo Alto Networks\Traps\cydump.exe` `C:\Program Files\Palo Alto Networks\Traps\cyreport.exe` `C:\Program Files\Palo Alto Networks\Traps\cyrprtui.exe` `C:\Program Files\Palo Alto Networks\Traps\cysandbox.exe` `C:\Program Files\Palo Alto Networks\Traps\cyuserserver.exe` `C:\Program Files\Palo Alto Networks\Traps\cywscsvc.exe` `C:\Program Files (x86)\Palo Alto Networks\Traps\cyreport.exe` `C:\Program Files (x86)\Palo Alto Networks\Traps\cyrprtui.exe`
Cortex XDR installation log	Specifies any errors encountered during installation of agent components. Use this log file when you need to troubleshoot installation issues. On Windows endpoints, the installer stores the log files in the `temp` or `C:\Users\<user_name>\AppData\Local\Temp` folder.
Cortex XDR agent service log	Indicates information, warnings, and errors related to the Cortex XDR. The Service log is located in the following folder on the endpoint: Windows Vista or a later Windows OS—`ProgramData\Cyvera\Logs` Windows XP—`C:\Document and Settings\All Users\Application Data\Cyvera\Logs`
Cortex XDR agent console log	Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint: Windows Vista or a later Windows OS—`C:\Users\<username>\AppData\Roaming\Cyvera` Windows XP—`C:\Document and Settings\<username>\Application Data\Cyvera\Logs`
Supervisor Command Line Tool (cytool.exe)	Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Windows.
Unknown files for analysis	The agent stores unknown files to send to Cortex XDR in the `C:\ProgramData\Cyvera\Temp` folder. After Cortex XDR submits a file to WildFire, the agent deletes the file from the Temp folder. In some cases, third-party Antivirus (AV) applications raise an alert for this folder. If this occurs, we recommend that you whitelist this folder in the third-party AV application.
Cortex XDR Health Helper	Improves the upgrade process of the Cortex XDR agent, which monitors the machine at startup and initiates an upgrade rollback in case of a failed upgrade. As upgrades have multiple re-tries, the next try works on the agent of its original version with no interference. The service only runs at startup and remains in pause mode during other times. To ensure this service is not removed, a periodic task would re-instate the process in case it was removed.


Resource	Description
Services, Drivers, and Processes	Services: `C:\Program Files\Palo Alto Networks\Traps\cyserver.exe` `C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\xdrhealth.exe` Drivers: `C:\Program Files\Palo Alto Networks\Traps\cyverak.sys` `C:\Program Files\Palo Alto Networks\Traps\cyvrmtgn.sys` `C:\Program Files\Palo Alto Networks\Traps\cyvrfsfd.sys` `C:\Program Files\Palo Alto Networks\Traps\tedrdrv.sys` `C:\Program Files\Palo Alto Networks\Traps\tdevflt.sys` `C:\Program Files\Palo Alto Networks\Traps\tedrpers-<version>.sys` `C:\Windows\System32\drivers\telam.sys` Processes: `C:\Program Files\Palo Alto Networks\Traps\CyveraConsole.exe` `C:\Program Files\Palo Alto Networks\Traps\tlaworker.exe` (background process that is always running) `C:\Program Files\Palo Alto Networks\Traps\cytray.exe` (background process that is always running) `C:\Program Files\Palo Alto Networks\Traps\cytool.exe` `C:\Program Files\Palo Alto Networks\Traps\cydump.exe` `C:\Program Files\Palo Alto Networks\Traps\cyreport.exe` `C:\Program Files\Palo Alto Networks\Traps\cyrprtui.exe` `C:\Program Files\Palo Alto Networks\Traps\cysandbox.exe` `C:\Program Files\Palo Alto Networks\Traps\cyuserserver.exe` `C:\Program Files\Palo Alto Networks\Traps\cywscsvc.exe` `C:\Program Files (x86)\Palo Alto Networks\Traps\cyreport.exe` `C:\Program Files (x86)\Palo Alto Networks\Traps\cyrprtui.exe` `C:\ProgramData\Cyvera\LocalSystem\Python\payload\cortex-xdr-payload.exe`
Cortex XDR installation log	Specifies any errors encountered during installation of agent components. Use this log file when you need to troubleshoot installation issues. On Windows endpoints, the installer stores the log files in the `temp` or `C:\Users\<user_name>\AppData\Local\Temp` folder.
Cortex XDR agent service log	Indicates information, warnings, and errors related to the Cortex XDR. The Service log is located in the following folder on the endpoint: Windows Vista or a later Windows OS—`ProgramData\Cyvera\Logs` Windows XP—`C:\Document and Settings\All Users\Application Data\Cyvera\Logs`
Cortex XDR agent console log	Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint: Windows Vista or a later Windows OS—`C:\Users\<username>\AppData\Roaming\Cyvera` Windows XP—`C:\Document and Settings\<username>\Application Data\Cyvera\Logs`
Supervisor Command Line Tool (cytool.exe)	Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Windows.
Unknown files for analysis	The agent stores unknown files to send to Cortex XDR in the `C:\ProgramData\Cyvera\Temp` folder. After Cortex XDR submits a file to WildFire, the agent deletes the file from the Temp folder. In some cases, third-party Antivirus (AV) applications raise an alert for this folder. If this occurs, we recommend that you whitelist this folder in the third-party AV application.
Cortex XDR Health Helper	Improves the upgrade process of the Cortex XDR agent, which monitors the machine at startup and initiates an upgrade rollback in case of a failed upgrade. As upgrades have multiple re-tries, the next try works on the agent of its original version with no interference. The service only runs at startup and remains in pause mode during other times. To ensure this service is not removed, a periodic task would re-instate the process in case it was removed.

Show markdown source

@@ -1,9 +1,9 @@
 ---
 description: >-
   Refer to the following troubleshooting resources for the Cortex XDR agent for
   Windows.
 ---
 
 # Troubleshooting resources for Windows
 
-<table data-header-hidden data-search="false"><thead><tr><th width="160.174560546875"></th><th width="549.5302734375"></th></tr></thead><tbody><tr><td>Resource</td><td>Description</td></tr><tr><td>Services, Drivers, and Processes</td><td><p>Services:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\cyserver.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\xdrhealth.exe</code></li></ul><p>Drivers:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\cyverak.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyvrmtgn.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyvrfsfd.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tedrdrv.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tdevflt.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tedrpers-&#x3C;version>.sys</code></li><li><code>C:\Windows\System32\drivers\telam.sys</code></li></ul><p>Processes:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\CyveraConsole.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tlaworker.exe</code> (background process that is always running)</li><li><code>C:\Program Files\Palo Alto Networks\Traps\cytray.exe</code> (background process that is always running)</li><li><code>C:\Program Files\Palo Alto Networks\Traps\cytool.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cydump.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyreport.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyrprtui.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cysandbox.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyuserserver.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cywscsvc.exe</code></li><li><code>C:\Program Files (x86)\Palo Alto Networks\Traps\cyreport.exe</code></li><li><code>C:\Program Files (x86)\Palo Alto Networks\Traps\cyrprtui.exe</code></li></ul></td></tr><tr><td>Cortex XDR installation log</td><td>Specifies any errors encountered during installation of agent components. Use this log file when you need to troubleshoot installation issues. On Windows endpoints, the installer stores the log files in the <code>temp</code> or <code>C:\Users\&#x3C;user_name>\AppData\Local\Temp</code> folder.</td></tr><tr><td>Cortex XDR agent service log</td><td><p>Indicates information, warnings, and errors related to the Cortex XDR. The Service log is located in the following folder on the endpoint:</p><ul><li><strong>Windows Vista or a later Windows OS</strong>—<code>ProgramData\Cyvera\Logs</code></li><li><strong>Windows XP</strong>—<code>C:\Document and Settings\All Users\Application Data\Cyvera\Logs</code></li></ul></td></tr><tr><td>Cortex XDR agent console log</td><td><p>Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint:</p><ul><li><strong>Windows Vista or a later Windows OS</strong>—<code>C:\Users\&#x3C;username>\AppData\Roaming\Cyvera</code></li><li><strong>Windows XP</strong>—<code>C:\Document and Settings\&#x3C;username>\Application Data\Cyvera\Logs</code></li></ul></td></tr><tr><td>Supervisor Command Line Tool (cytool.exe)</td><td>Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Windows.</td></tr><tr><td>Unknown files for analysis</td><td><p>The agent stores unknown files to send to Cortex XDR in the <code>C:\ProgramData\Cyvera\Temp</code> folder. After Cortex XDR submits a file to WildFire, the agent deletes the file from the Temp folder.</p><p>In some cases, third-party Antivirus (AV) applications raise an alert for this folder. If this occurs, we recommend that you whitelist this folder in the third-party AV application.</p></td></tr><tr><td>Cortex XDR Health Helper</td><td>Improves the upgrade process of the Cortex XDR agent, which monitors the machine at startup and initiates an upgrade rollback in case of a failed upgrade. As upgrades have multiple re-tries, the next try works on the agent of its original version with no interference. The service only runs at startup and remains in pause mode during other times. To ensure this service is not removed, a periodic task would re-instate the process in case it was removed.</td></tr></tbody></table>
+<table data-header-hidden data-search="false"><thead><tr><th width="160.174560546875"></th><th width="559.95556640625"></th></tr></thead><tbody><tr><td>Resource</td><td>Description</td></tr><tr><td>Services, Drivers, and Processes</td><td><p>Services:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\cyserver.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\xdrhealth.exe</code></li></ul><p>Drivers:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\cyverak.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyvrmtgn.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyvrfsfd.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tedrdrv.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tdevflt.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tedrpers-&#x3C;version>.sys</code></li><li><code>C:\Windows\System32\drivers\telam.sys</code></li></ul><p>Processes:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\CyveraConsole.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tlaworker.exe</code> (background process that is always running)</li><li><code>C:\Program Files\Palo Alto Networks\Traps\cytray.exe</code> (background process that is always running)</li><li><code>C:\Program Files\Palo Alto Networks\Traps\cytool.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cydump.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyreport.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyrprtui.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cysandbox.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyuserserver.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cywscsvc.exe</code></li><li><code>C:\Program Files (x86)\Palo Alto Networks\Traps\cyreport.exe</code></li><li><code>C:\Program Files (x86)\Palo Alto Networks\Traps\cyrprtui.exe</code> </li><li><code>C:\ProgramData\Cyvera\LocalSystem\Python\payload\cortex-xdr-payload.exe</code></li></ul></td></tr><tr><td>Cortex XDR installation log</td><td>Specifies any errors encountered during installation of agent components. Use this log file when you need to troubleshoot installation issues. On Windows endpoints, the installer stores the log files in the <code>temp</code> or <code>C:\Users\&#x3C;user_name>\AppData\Local\Temp</code> folder.</td></tr><tr><td>Cortex XDR agent service log</td><td><p>Indicates information, warnings, and errors related to the Cortex XDR. The Service log is located in the following folder on the endpoint:</p><ul><li><strong>Windows Vista or a later Windows OS</strong>—<code>ProgramData\Cyvera\Logs</code></li><li><strong>Windows XP</strong>—<code>C:\Document and Settings\All Users\Application Data\Cyvera\Logs</code></li></ul></td></tr><tr><td>Cortex XDR agent console log</td><td><p>Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint:</p><ul><li><strong>Windows Vista or a later Windows OS</strong>—<code>C:\Users\&#x3C;username>\AppData\Roaming\Cyvera</code></li><li><strong>Windows XP</strong>—<code>C:\Document and Settings\&#x3C;username>\Application Data\Cyvera\Logs</code></li></ul></td></tr><tr><td>Supervisor Command Line Tool (cytool.exe)</td><td>Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Windows.</td></tr><tr><td>Unknown files for analysis</td><td><p>The agent stores unknown files to send to Cortex XDR in the <code>C:\ProgramData\Cyvera\Temp</code> folder. After Cortex XDR submits a file to WildFire, the agent deletes the file from the Temp folder.</p><p>In some cases, third-party Antivirus (AV) applications raise an alert for this folder. If this occurs, we recommend that you whitelist this folder in the third-party AV application.</p></td></tr><tr><td>Cortex XDR Health Helper</td><td>Improves the upgrade process of the Cortex XDR agent, which monitors the machine at startup and initiates an upgrade rollback in case of a failed upgrade. As upgrades have multiple re-tries, the next try works on the agent of its original version with no interference. The service only runs at startup and remains in pause mode during other times. To ensure this service is not removed, a periodic task would re-instate the process in case it was removed.</td></tr></tbody></table>

▸ Cytool for Windows modified +80 −1 The Cytool options table gained full command output examples for imageprep, info, policy compare, protect, scan and startup. agent/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cytool-for-windows

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -13,9 +13,88 @@ On Windows endpoints, you can access Cytool using a Microsoft command prompt tha

The following table displays the Cytool options available on Windows endpoints. Where there is a password required for admin commands, this is the same password as was defined as the Uninstall Password.

hint info

### Note

Since the Cortex XDR agent 7.6 release for Windows, the cyserver.exe process includes and replaces the previous CyveraService.exe, tlaservice.exe, and twdservice.exe high-privileged processes.

endhint


Command Option	Description
adaptive_policy	Adaptive policy agent commands Usage `cytool adaptive_policy [interval <seconds
cert_enforcement	Perform Certificate enforcement related operations. Usage: `cytool cert_enforcement <operation>` Where <operation> is one of the following: query Display current enforcement status disable Forcibly disable enforcement policy Set enforcement by policy import <certificate file path> Import a proprietary certificate in PEM format as root CA import clear Clear all custom root CA certificates.
checkin	Initiate check-in to the server. Usage: `cytool checkin` To verify the checkin, view the check-in time on the agent console.
edr	Display EDR stats collected on the endpoint. Usage: `cytool edr stats`
endpoint_tags	Use Endpoint Tags to identify groups of endpoints. Usage: `cytool endpoint_tags <action>` Where action can be: add—Add tags to the endpoint tag list. remove—Remove the given tags from the list of endpoint tags. list—Display the available list of endpoint tags. Note Tags should be passed as one string, separated by commas, and with no spaces. Example: `cytool endpoint_tags add "tag1[,tage2,...,tagN]"` `cytool endpoint_tags remove "tag1[,tage2,...,tagN]"` `cytool endpoint_tags list "tag1[,tage2,...,tagN]"`
enum	Enumerate protected processes. Usage: `cytool enum` Note If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.
event_collection	Perform event collection (EDR/DSE) operations. Usage: `cytool event_collection <operation>` Where <operation> can be: query—Displays the current event collection status. enable—Start or stop event collection as set by policy. disable—Forcibly stops event collection. logstat—Writes internal statistics to the log file.
image	Display information about a PE file (executable or DLL). Usage: `cytool image <filename>` For example: `C:\Program Files\Palo Alto Networks\Traps> cytool image json.dll Image Information Location: json.dll Size: 176.98 KB (181224 bytes) File SHA256: a46b8e1ad9a808fb09e7b79bd03b66a611d0c7aa71291c216be555af14d16421 Architecture: x86-64 Subsystem: Windows GUI PE Size: 156.00 KB (159744 bytes) PE SHA256: 8cbca46419bf7260c99aaa3c73a6944e97f5c5b053a8b88e9a17367439b08d7d`
imageprep	Prepare a golden image by submitting files for cloud analysis and generate a threats report. Usage: `cytool imageprep [scan] [timeout <scan timeout>][upload <upload timeout>] [path <full path>]` where: <scan timeout>—The number of hours the scan is permitted to run before reporting an error. <upload timeout>—The number of minutes the agent can take to upload unknown files to Cortex XDR before reporting an error. <full path>—Path to store the scan report. If no path is specified, Cytool saves the scan report to the local Cytool directory. To save files to this folder, you must first disable service protection using the `cytool protect disable` command. Example: `C:\Program Files\Palo Alto Networks\Traps> cytool imageprep scan timeout 4 upload 60 path c:\report Start Time : 17:56:46 Elapsed Time : 00:04:17 State : Running Scanned Files : 5427 Suspicious Files : 0 Failed Files : 9 Volume Root Path : \\?\C:\ Window Usage : 0 236 20000 Path : ...t\cache2\entries\9B982CE198BF046E6CCF25478920DDFD9E5842E5 Scan completed successfully Complete report can be found at: C:\report\imageprep_2019-03-06_08-59-30.xml`
import	Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.
info	Display general Cortex XDR agent information. Usage: `cytool info [query]` To display the agent version, run the `cytool info` command without any additional arguments. To display additional details about the agent, such as the version of the default policy and the specific build number, add the query argument.
isolate	Release endpoint from network isolation. Usage: `cytool isolate stop`
last_checkin	Display the time of the last successful check-in. Usage: `cytool last_checkin`
log	Set log level for the desired process/Generate support file archive. Usage: `cytool log set_level <log_level> <Components
payload_execution	Stop or query payload execution status. Relates to Live Terminal and script execution. Usage: cytool payload_execution query—Display current payload execution status. cytool payload_execution stop—Stop payload execution.
persist	The Cortex XDR agent stores policy and security event information, such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database. Usage: `cytoolpersist <action>` Where <action> can be: list—Lists the local databases on the endpoint. export [<database name> \| <databasepath>]—Exports the database table to a file in the `C:\Users\<user>\Documents\PaloAltoNetworks\Traps\cytool` directory. import [<database name> \| <databasepath>] <file name>—Adds the records in a JSON file to the database. print <database name> \| <databasepath> [csv]—Prints the records in the database to a CSV file. To view a list of all local databases, use the `cytool persist list` command.
policy	Query or compare the applied policy for a process. Usage: `cytool policy [query
protect	Enable or disable a protection feature. Usage: cytool protect `<Action>` `<Feature>` where: <Action>—Changes protection for an agent feature. Options are: `enable` `disable` `policy` `query`. The query option displays the protection status for each feature. `<Feature>`—Specifies the feature for which you want to change the protection status. Options are: `Process`, for agent core processes `Registry`, for agent registry keys `File`, for agent files `Service`, for agent services `Pipe`, for protection of agent pipes. For example: To disable registry protection, `CYTOOL protect disable registry` To enable all protection, `CYTOOL protect enable` To set protection according to policy, `CYTOOL protect policy` Note Any protection state change made by Cytool persists until the next reboot and is set according to the policy one hour after reboot.
proxy	Set or query cloud-defined proxies for the agent. Usage: `cytool proxy query`—Display the current status of cloud-defined proxy settings. `cytool proxy set <list>`—Set cloud-defined proxy settings to the proxies defined in <list>. For example: `cytool proxy set "192.168.50.1:8080,192.168.60.2:808"` `cytool proxy set ""`—Disable cloud-defined proxy.
quarantine	View and restore quarantined files. Usage: `cytool quarantine list`—List all quarantined files. `cytool restore <ID> [<path>]`—Restore files to their original location or to a path, if specified, by specifying the file ID.
queryall	The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.
reconnect	Try reconnecting to the server if communication has been disabled, or force registration with a new `distribution_id`. Usage: `cytool reconnect`—Reconnects the Cortex XDR agent to the management application on the server. `cytool reconnect [force <distribution_id]>` Note The `distribution_id` must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.
runtime	Stop or start product components. Usage: `cytool runtime <Action> <Component>` where: <Action>—Changes startup runtime action for an agent component. Options are: `start`, `stop`, and `query`. The query option displays the startup status for each component. <Component>—Specifies the component for which you want to change the runtime action, or you can specify all components by not including any in this command. To change the runtime action for a subset of components, list them with spaces separating each component. Options are: `cyverak`, `cyvrmtgn`, `cyvrfsfd`, and `cyserver`. For example: `C:\Program Files\Palo Alto Networks\Traps>cytool runtime stop cyserver cyverak Enter supervisor password: Service State cyverak Stopped cyvrmtgn Running cyvrfsfd Running cyserver Stopped`
scan	Scan operations. Usage: `cytool scan <Action>` Where <action>: `start`—Scans the endpoint for malware. `stop`—Stops a scan. `query`—Displays the progress if a system scan is active. `last_scan_time`—Displays the last time a scan was done. Example: `C:\Program Files\Palo Alto Networks\Traps> cytool scan start Enter supervisor password: The operation completed successfully. C:\Program Files\Palo Alto Networks\Traps> cytool scan query Enter supervisor password: Start Time : 9:09:0648 Elapsed Time : 00:00:51 State : Running Scanned Files : 3944 Suspicious Files : 0 Failed Files : 1\?\C:\ Volume Root Path : \\?\C:\ 8 20000 Window Usage : 0 14 20000 Path : ...`


Command Option	Description
adaptive_policy	Adaptive policy agent commands Usage `cytool adaptive_policy [interval <seconds \| policy> \| collect_stats \| recalc \| query]` Where: `interval` —Sets a recalculation interval override (in seconds), or resets an override. Options are: seconds/policy. `collect_stats`—Initiates a collection of internal statistics. `recalc`—Triggers a recalculation of the adaptive policy. `query`—Querys the current interval and APEX.
cert_enforcement	Perform Certificate enforcement related operations. Usage: `cytool cert_enforcement <operation>` Where <operation> is one of the following: `query`—Displays current enforcement status `disable`—Forcibly disables enforcement `policy`—Sets enforcement by policy `import <certificate file path>`—Imports a proprietary certificate in PEM format as root CA `import clear` —Clears all custom root CA certificates.
checkin	Initiate check-in to the server. Usage: `cytool checkin` To verify the checkin, view the check-in time on the agent console.
clean_and_install	Trigger the XDR Health Helper service to remediate corrupted agent installations or failed upgrades by removing the existing agent and performing a fresh installation. Usage: `cytool clean_and_install [-cs "<options_json>"]` Where `<options_json>` can include one of the following execution modes: `{"ExecutionMode":0}` — Removes and reinstalls the current version of the agent. `{"ExecutionMode":1}` — Attempts to upgrade to the desired version and stops if the upgrade fails. `{"ExecutionMode":2}` — (Default) Attempts to upgrade to the desired version and falls back to reinstalling the current version if the upgrade fails. For example: `cytool clean_and_install -cs "{\"ExecutionMode\":0}"`
edr	Display EDR stats collected on the endpoint. Usage: `cytool edr stats`
endpoint_tags	Use Endpoint Tags to identify groups of endpoints. Usage: `cytool endpoint_tags <action>` Where action can be: `add`—Adds tags to the endpoint tag list. `remove`—Removes the given tags from the list of endpoint tags. `list`—Displays the available list of endpoint tags. Note Tags should be passed as one string, separated by commas, and with no spaces. For example: `cytool endpoint_tags add "tag1[,tage2,...,tagN]"` `cytool endpoint_tags remove "tag1[,tage2,...,tagN]"` `cytool endpoint_tags list "tag1[,tage2,...,tagN]"`
enum	Enumerate protected processes. Usage: `cytool enum` Note If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.
event_collection	Perform event collection (EDR/DSE) operations. Usage: `cytool event_collection <operation>` Where <operation> can be: `query`—Displays the current event collection status. `enable`—Start or stop event collection as set by policy. `disable`—Forcibly stops event collection. `logstat`—Writes internal statistics to the log file.
image	Display information about a PE file (executable or DLL). Usage: `cytool image <filename>` For example: `C:\Program Files\Palo Alto Networks\Traps> cytool image json.dll`

Image Information

Location: json.dll

Size: 176.98 KB (181224 bytes)

File SHA256: a46b8e1ad9a808fb09e7b79bd03b66a611d0c7aa71291c216be555af14d16421

Architecture: x86-64

Subsystem: Windows GUI

PE Size: 156.00 KB (159744 bytes)

PE SHA256: 8cbca46419bf7260c99aaa3c73a6944e97f5c5b053a8b88e9a17367439b08d7d

</code></pre></td></tr><tr><td>imageprep</td><td>Prepare a golden image by submitting files for cloud analysis and generate a threats report.Usage: cytool imageprep [scan] [timeout <scan timeout>][upload <upload timeout>] [path <full path>]where:<ul><li><scan timeout>—The number of hours the scan is permitted to run before reporting an error.</li><li><upload timeout>—The number of minutes the agent can take to upload unknown files to Cortex XDR before reporting an error.</li><li><full path>—Path to store the scan report. If no path is specified, Cytool saves the scan report to the local Cytool directory. To save files to this folder, you must first disable service protection using the cytool protect disable command.</li></ul>For example:<pre>C:\Program Files\Palo Alto Networks\Traps> cytool imageprep scan timeout 4 upload 60 path c:\report

Start Time : 17:56:46

Elapsed Time : 00:04:17

State : Running

Scanned Files : 5427

Suspicious Files : 0

Failed Files : 9

Volume Root Path : \?\C:\

Window Usage : 0 236 20000

Path : ...t\cache2\entries\9B982CE198BF046E6CCF25478920DDFD9E5842E5

Scan completed successfully

Complete report can be found at: C:\report\imageprep_2019-03-06_08-59-30.xml

</code></pre></td></tr><tr><td>import</td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>info</td><td>Display general Cortex XDR agent information.Usage: cytool info [query]<ul><li>To display the agent version, run the cytool info command without any additional arguments.</li><li>To display additional details about the agent, such as the version of the default policy and the specific build number, add the query argument.</li></ul></td></tr><tr><td>isolate</td><td>Release endpoint from network isolation.Usage: cytool isolate stop</td></tr><tr><td>last_checkin</td><td>Display the time of the last successful check-in.Usage: cytool last_checkin</td></tr><tr><td>log</td><td>Set log level for the desired process/Generate support file archive.Usage: cytool log set_level <log_level> <Components|all>where:<log_level>—An integer value corresponding to the log level:<ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul><Components> can be cyserver or all Use cytool log collect to generate a support file archive of all logs in a TGZ file.</td></tr><tr><td>payload_execution</td><td>Stop or query payload execution status. Relates to Live Terminal and script execution.Usage:<ul><li>cytool payload_execution query—Displays current payload execution status.</li><li>cytool payload_execution stop—Stops payload execution.</li></ul></td></tr><tr><td>persist</td><td>The Cortex XDR agent stores policy and security event information, such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.Usage: cytool persist <action>Where <action> can be:<ul><li>list—Lists the local databases on the endpoint.</li><li>export [<database name> | <databasepath>]—Exports the database table to a file in the C:\Users\<user>\Documents\PaloAltoNetworks\Traps\cytool directory.</li><li>import [<database name> | <databasepath>] <file name>—Adds the records in a JSON file to the database.</li><li>print <database name> | <databasepath> [csv]—Prints the records in the database to a CSV file.</li></ul>To view a list of all local databases, use the cytool persist list command.</td></tr><tr><td>policy</td><td>Query or compare the applied policy for a process.Usage: cytool policy [query | compare] [process [process]]where:<ul><li>Options are:query—Displays the current applied policy for the process.compare —Compares the policy against the policy for another process, or against the default policy.</li><li><process>—Either the process name or process ID (PID).</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info">Note: If an image name is specified, a new policy is generated as if the process was created. If a process ID is specified, the system queries the effective policy for the running process.</div>For example:To query the policy for future executions of notepad.exe:<pre>C:\Program Files\Palo Alto Networks\Traps> cytool policy query notepad.exe

Enter supervisor password:

Generic

Enable 0x00000001

LongHooks 0x00000000

StaticHooks 0x00000000

NoCallSplitting 0x00000000

InitSecurityCookie 0x00000000

DontInjectThinApp 0x00000001

LeanInjection 0x00000000

B01

Enable 0x00000000

BlockAPI 0x00000000

[...]

</code></pre>To compare the policy for future executions of notepad.exe to the default policy:<pre>C:\Program Files\Palo Alto Networks\Traps> cytool policy compare notepad.exe default

Enter supervisor password:

Generic

Enable 0x00000001 0x00000001

LongHooks 0x00000000 0x00000000

StaticHooks 0x00000000 0x00000000

NoCallSplitting 0x00000000 0x00000000

InitSecurityCookie 0x00000000 0x00000000

DontInjectThinApp 0x00000001 0x00000001

LeanInjection 0x00000000 0x00000000

B01

Enable 0x00000000 0x00000000

BlockAPI 0x00000000 0x00000000

[...]

</code></pre>cytool policy query 1337Query the policy of process with ID 1337.cytool policy compare notepad.exe 1337Compare notepad's and process ID 1337 policies.</td></tr><tr><td>protect</td><td>Enable or disable a protection feature.Usage: cytool protect <Action> <Feature>where:<ul><li><Action>—Changes protection for an agent feature. Options are:enabledisablepolicyqueryThe query option displays the protection status for each feature.</li><li><Feature>—Specifies the feature for which you want to change the protection status. Options are:Process, for agent core processesRegistry, for agent registry keysFile, for agent filesService, for agent servicesPipe, for protection of agent pipes.</li></ul>For example:To disable registry protection,cytool protect disable registryTo enable all protection,cytool protect enableTo set protection according to policy,cytool protect policy<div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info">NoteAny protection state change made by Cytool persists until the next reboot and is set according to the policy one hour after reboot.</div></td></tr><tr><td>proxy</td><td>Set or query cloud-defined proxies for the agent.Usage:<ul><li>cytool proxy query—Displays the current status of cloud-defined proxy settings.</li><li>cytool proxy set <list>—Sets cloud-defined proxy settings to the proxies defined in <list>.For example: cytool proxy set "192.168.50.1:8080,192.168.60.2:808"</li><li>cytool proxy set ""—Disables cloud-defined proxy.</li></ul></td></tr><tr><td>quarantine</td><td>View and restore quarantined files.Usage:<ul><li>cytool quarantine list—Lists all quarantined files.</li><li>cytool restore <ID> [<path>]—Restores files to their original location or to a path, if specified, by specifying the file ID.</li></ul></td></tr><tr><td>queryall</td><td>Display a list of imported certificates for troubleshooting purposes.</td></tr><tr><td>reconnect</td><td>Try reconnecting to the server if communication has been disabled, or force registration with a new distribution_id.Usage:<ul><li>cytool reconnect—Reconnects the Cortex XDR agent to the management application on the server.</li><li>cytool reconnect [force <distribution_id]></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info">NoteThe distribution_id must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</div></td></tr><tr><td>runtime</td><td>Stop or start product components.Usage: cytool runtime <Action> <Component>where:<ul><li><Action>—Changes startup runtime action for an agent component.Options are: start, stop, and query. The query option displays the startup status for each component.</li><li><Component>—Specifies the component for which you want to change the runtime action, or you can specify all components by not including any in this command.To change the runtime action for a subset of components, list them with spaces separating each component.Options are: cyverak, cyvrmtgn, cyvrfsfd, and cyserver.</li></ul>For example:<pre>C:\Program Files\Palo Alto Networks\Traps>cytool runtime stop cyserver cyverak

Enter supervisor password:

Service State

cyverak Stopped

cyvrmtgn Running

cyvrfsfd Running

cyserver Stopped

</code></pre></td></tr><tr><td>scan</td><td>Scan operations.Usage: cytool scan <Action>Where <action>:<ul><li>start—Scans the endpoint for malware.</li><li>stop—Stops a scan.</li><li>query—Displays the progress if a system scan is active.</li><li>last_scan_time—Displays the last time a scan was done.</li></ul>Example:<pre>C:\Program Files\Palo Alto Networks\Traps> cytool scan start

Enter supervisor password:

The operation completed successfully.

C:\Program Files\Palo Alto Networks\Traps> cytool scan query

Enter supervisor password:

Start Time : 9:09:0648

Elapsed Time : 00:00:51

State : Running

Scanned Files : 3944

Suspicious Files : 0

Failed Files : 1\?\C:\

Volume Root Path : \?\C:\ 8 20000

Window Usage : 0 14 20000

Path : ...

</code></pre></td></tr></tbody></table>

Show markdown source

@@ -13,9 +13,88 @@ On Windows endpoints, you can access Cytool using a Microsoft command prompt tha
 The following table displays the Cytool options available on Windows endpoints. Where there is a password required for admin commands, this is the same password as was defined as the Uninstall Password.
 
 {% hint style="info" %}
 ### Note
 
 Since the Cortex XDR agent 7.6 release for Windows, the cyserver.exe process includes and replaces the previous CyveraService.exe, tlaservice.exe, and twdservice.exe high-privileged processes.
 {% endhint %}
 
-<table data-header-hidden><thead><tr><th width="199.2725830078125"></th><th></th></tr></thead><tbody><tr><td>Command Option</td><td>Description</td></tr><tr><td>adaptive_policy</td><td><p>Adaptive policy agent commands</p><p>Usage `cytool adaptive_policy [interval &#x3C;seconds</p></td></tr><tr><td>cert_enforcement</td><td><p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li>query                       Display current enforcement status</li><li>disable                     Forcibly disable enforcement</li><li>policy                      Set enforcement by policy</li><li>import &#x3C;certificate file path>     Import a proprietary certificate in PEM format as root CA</li><li>import clear                       Clear all custom root CA certificates.</li></ul></td></tr><tr><td>checkin</td><td><p>Initiate check-in to the server.</p><p>Usage: <code>cytool checkin</code></p><p>To verify the checkin, view the check-in time on the agent console.</p></td></tr><tr><td>edr</td><td><p>Display EDR stats collected on the endpoint.</p><p>Usage: <code>cytool edr stats</code></p></td></tr><tr><td>endpoint_tags</td><td><p>Use Endpoint Tags to identify groups of endpoints.</p><p>Usage: <code>cytool endpoint_tags &#x3C;action></code></p><p>Where action can be:</p><ul><li>add—Add tags to the endpoint tag list.</li><li>remove—Remove the given tags from the list of endpoint tags.</li><li>list—Display the available list of endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string, separated by commas, and with no spaces.</p></div><p>Example:</p><ul><li><code>cytool endpoint_tags add "tag1[,tage2,...,tagN]"</code></li><li><code>cytool endpoint_tags remove "tag1[,tage2,...,tagN]"</code></li><li><code>cytool endpoint_tags list "tag1[,tage2,...,tagN]"</code></li></ul></td></tr><tr><td>enum</td><td><p>Enumerate protected processes.</p><p>Usage: <code>cytool enum</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.</p></div></td></tr><tr><td>event_collection</td><td><p>Perform event collection (EDR/DSE) operations.</p><p>Usage: <code>cytool event_collection &#x3C;operation></code></p><p>Where &#x3C;operation> can be:</p><ul><li>query—Displays the current event collection status.</li><li>enable—Start or stop event collection as set by policy.</li><li>disable—Forcibly stops event collection.</li><li>logstat—Writes internal statistics to the log file.</li></ul></td></tr><tr><td>image</td><td><p>Display information about a PE file (executable or DLL).</p><p>Usage: <code>cytool image &#x3C;filename></code></p><p>For example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps> cytool image json.dll Image Information Location: json.dll Size: 176.98 KB (181224 bytes) File SHA256: a46b8e1ad9a808fb09e7b79bd03b66a611d0c7aa71291c216be555af14d16421 Architecture: x86-64 Subsystem: Windows GUI PE Size: 156.00 KB (159744 bytes) PE SHA256: 8cbca46419bf7260c99aaa3c73a6944e97f5c5b053a8b88e9a17367439b08d7d</code></p></td></tr><tr><td>imageprep</td><td><p>Prepare a golden image by submitting files for cloud analysis and generate a threats report.</p><p>Usage: <code>cytool imageprep [scan] [timeout &#x3C;scan timeout>][upload &#x3C;upload timeout>] [path &#x3C;full path>]</code></p><p>where:</p><ul><li>&#x3C;scan timeout>—The number of hours the scan is permitted to run before reporting an error.</li><li>&#x3C;upload timeout>—The number of minutes the agent can take to upload unknown files to Cortex XDR before reporting an error.</li><li>&#x3C;full path>—Path to store the scan report. If no path is specified, Cytool saves the scan report to the local Cytool directory. To save files to this folder, you must first disable service protection using the <code>cytool protect disable</code> command.</li></ul><p>Example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps> cytool imageprep scan timeout 4 upload 60 path c:\report Start Time : 17:56:46 Elapsed Time : 00:04:17 State : Running Scanned Files : 5427 Suspicious Files : 0 Failed Files : 9 Volume Root Path : \\?\C:\ Window Usage : 0 236 20000 Path : ...t\cache2\entries\9B982CE198BF046E6CCF25478920DDFD9E5842E5 Scan completed successfully Complete report can be found at: C:\report\imageprep_2019-03-06_08-59-30.xml</code></p></td></tr><tr><td>import</td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>info</td><td><p>Display general Cortex XDR agent information.</p><p>Usage: <code>cytool info [query]</code></p><ul><li>To display the agent version, run the <code>cytool info</code> command without any additional arguments.</li><li>To display additional details about the agent, such as the version of the default policy and the specific build number, add the query argument.</li></ul></td></tr><tr><td>isolate</td><td><p>Release endpoint from network isolation.</p><p>Usage: <code>cytool isolate stop</code></p></td></tr><tr><td>last_checkin</td><td><p>Display the time of the last successful check-in.</p><p>Usage: <code>cytool last_checkin</code></p></td></tr><tr><td>log</td><td><p>Set log level for the desired process/Generate support file archive.</p><p>Usage: `cytool log set_level &#x3C;log_level> &#x3C;Components</p></td></tr><tr><td>payload_execution</td><td><p>Stop or query payload execution status. Relates to Live Terminal and script execution.</p><p>Usage:</p><ul><li>cytool payload_execution query—Display current payload execution status.</li><li>cytool payload_execution stop—Stop payload execution.</li></ul></td></tr><tr><td>persist</td><td><p>The Cortex XDR agent stores policy and security event information, such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <code>cytoolpersist &#x3C;action></code></p><p>Where &#x3C;action> can be:</p><ul><li>list—Lists the local databases on the endpoint.</li><li>export [&#x3C;database name> | &#x3C;databasepath>]—Exports the database table to a file in the <code>C:\Users\&#x3C;user>\Documents\PaloAltoNetworks\Traps\cytool</code> directory.</li><li>import [&#x3C;database name> | &#x3C;databasepath>] &#x3C;file name>—Adds the records in a JSON file to the database.</li><li>print &#x3C;database name> | &#x3C;databasepath> [csv]—Prints the records in the database to a CSV file.</li></ul><p>To view a list of all local databases, use the <code>cytool persist list</code> command.</p></td></tr><tr><td>policy</td><td><p>Query or compare the applied policy for a process.</p><p>Usage: `cytool policy [query</p></td></tr><tr><td>protect</td><td><p>Enable or disable a protection feature.</p><p>Usage: cytool protect <code>&#x3C;Action></code> <code>&#x3C;Feature></code></p><p>where:</p><ul><li><p>&#x3C;Action>—Changes protection for an agent feature. Options are:</p><p><code>enable</code></p><p><code>disable</code></p><p><code>policy</code></p><p><code>query</code>. The query option displays the protection status for each feature.</p></li><li><p><strong><code>&#x3C;Feature></code></strong>—Specifies the feature for which you want to change the protection status. Options are:</p><p><code>Process</code>, for agent core processes</p><p><code>Registry</code>, for agent registry keys</p><p><code>File</code>, for agent files</p><p><code>Service</code>, for agent services</p><p><code>Pipe</code>, for protection of agent pipes.</p></li></ul><p>For example:</p><p>To disable registry protection,</p><p><code>CYTOOL protect disable registry</code></p><p>To enable all protection,</p><p><code>CYTOOL protect enable</code></p><p>To set protection according to policy,</p><p><code>CYTOOL protect policy</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Any protection state change made by Cytool persists until the next reboot and is set according to the policy one hour after reboot.</p></div></td></tr><tr><td>proxy</td><td><p>Set or query cloud-defined proxies for the agent.</p><p>Usage:</p><ul><li><code>cytool proxy query</code>—Display the current status of cloud-defined proxy settings.</li><li><p><code>cytool proxy set &#x3C;list></code>—Set cloud-defined proxy settings to the proxies defined in &#x3C;list>.</p><p>For example: <code>cytool proxy set "192.168.50.1:8080,192.168.60.2:808"</code></p></li><li><code>cytool proxy set ""</code>—Disable cloud-defined proxy.</li></ul></td></tr><tr><td>quarantine</td><td><p>View and restore quarantined files.</p><p>Usage:</p><ul><li><code>cytool quarantine list</code>—List all quarantined files.</li><li><code>cytool restore &#x3C;ID> [&#x3C;path>]</code>—Restore files to their original location or to a path, if specified, by specifying the file ID.</li></ul></td></tr><tr><td>queryall</td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td>reconnect</td><td><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div></td></tr><tr><td>runtime</td><td><p>Stop or start product components.</p><p>Usage: <code>cytool runtime &#x3C;Action> &#x3C;Component></code></p><p>where:</p><ul><li><p>&#x3C;Action>—Changes startup runtime action for an agent component.</p><p>Options are: <code>start</code>, <code>stop</code>, and <code>query</code>. The query option displays the startup status for each component.</p></li><li><p>&#x3C;Component>—Specifies the component for which you want to change the runtime action, or you can specify all components by not including any in this command.</p><p>To change the runtime action for a subset of components, list them with spaces separating each component.</p><p>Options are: <code>cyverak</code>, <code>cyvrmtgn</code>, <code>cyvrfsfd</code>, and <code>cyserver</code>.</p></li></ul><p>For example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps>cytool runtime stop cyserver cyverak Enter supervisor password: Service State cyverak Stopped cyvrmtgn Running cyvrfsfd Running cyserver Stopped</code></p></td></tr><tr><td>scan</td><td><p>Scan operations.</p><p>Usage: <code>cytool scan &#x3C;Action></code></p><p>Where &#x3C;action>:</p><ul><li><code>start</code>—Scans the endpoint for malware.</li><li><code>stop</code>—Stops a scan.</li><li><code>query</code>—Displays the progress if a system scan is active.</li><li><code>last_scan_time</code>—Displays the last time a scan was done.</li></ul><p>Example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps> cytool scan start Enter supervisor password: The operation completed successfully. C:\Program Files\Palo Alto Networks\Traps> cytool scan query Enter supervisor password: Start Time : 9:09:0648 Elapsed Time : 00:00:51 State : Running Scanned Files : 3944 Suspicious Files : 0 Failed Files : 1\?\C:\ Volume Root Path : \\?\C:\ 8 20000 Window Usage : 0 14 20000 Path : ...</code></p></td></tr></tbody></table>
+<table data-header-hidden><thead><tr><th width="187.8446044921875"></th><th width="599.5780029296875"></th></tr></thead><tbody><tr><td>Command Option</td><td>Description</td></tr><tr><td>adaptive_policy</td><td><p>Adaptive policy agent commands</p><p>Usage <code>cytool adaptive_policy [interval &#x3C;seconds | policy> | collect_stats | recalc | query]</code></p><p>Where:</p><ul><li><code>interval</code> —Sets a recalculation interval override (in seconds), or resets an override. Options are: seconds/policy.</li><li><code>collect_stats</code>—Initiates a collection of internal statistics.</li><li><code>recalc</code>—Triggers a recalculation of the adaptive policy.</li><li><code>query</code>—Querys the current interval and APEX.</li></ul></td></tr><tr><td>cert_enforcement</td><td><p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li><code>query</code>—Displays current enforcement status</li><li><code>disable</code>—Forcibly disables enforcement</li><li><code>policy</code>—Sets enforcement by policy</li><li><code>import &#x3C;certificate file path></code>—Imports a proprietary certificate in PEM format as root CA</li><li><code>import clear</code> —Clears all custom root CA certificates.</li></ul></td></tr><tr><td>checkin</td><td><p>Initiate check-in to the server.</p><p>Usage: <code>cytool checkin</code></p><p>To verify the checkin, view the check-in time on the agent console.</p></td></tr><tr><td>clean_and_install</td><td><p>Trigger the XDR Health Helper service to remediate corrupted agent installations or failed upgrades by removing the existing agent and performing a fresh installation.<br>Usage: <code>cytool clean_and_install [-cs "&#x3C;options_json>"]</code> </p><p><br>Where <code>&#x3C;options_json></code> can include one of the following execution modes:</p><ul><li><code>{"ExecutionMode":0}</code> — Removes and reinstalls the current version of the agent.</li><li><code>{"ExecutionMode":1}</code> — Attempts to upgrade to the desired version and stops if the upgrade fails.</li><li><code>{"ExecutionMode":2}</code> — (Default) Attempts to upgrade to the desired version and falls back to reinstalling the current version if the upgrade fails.</li></ul><p>For example:</p><p><code>cytool clean_and_install -cs "{\"ExecutionMode\":0}"</code></p></td></tr><tr><td>edr</td><td><p>Display EDR stats collected on the endpoint.</p><p>Usage: <code>cytool edr stats</code></p></td></tr><tr><td>endpoint_tags</td><td><p>Use Endpoint Tags to identify groups of endpoints.</p><p>Usage: <code>cytool endpoint_tags &#x3C;action></code></p><p>Where action can be:</p><ul><li><code>add</code>—Adds tags to the endpoint tag list.</li><li><code>remove</code>—Removes the given tags from the list of endpoint tags.</li><li><code>list</code>—Displays the available list of endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string, separated by commas, and with no spaces.</p></div><p>For example:</p><ul><li><code>cytool endpoint_tags add "tag1[,tage2,...,tagN]"</code></li><li><code>cytool endpoint_tags remove "tag1[,tage2,...,tagN]"</code></li><li><code>cytool endpoint_tags list "tag1[,tage2,...,tagN]"</code></li></ul></td></tr><tr><td>enum</td><td><p>Enumerate protected processes.</p><p>Usage: <code>cytool enum</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.</p></div></td></tr><tr><td>event_collection</td><td><p>Perform event collection (EDR/DSE) operations.</p><p>Usage: <code>cytool event_collection &#x3C;operation></code></p><p>Where &#x3C;operation> can be:</p><ul><li><code>query</code>—Displays the current event collection status.</li><li><code>enable</code>—Start or stop event collection as set by policy.</li><li><code>disable</code>—Forcibly stops event collection.</li><li><code>logstat</code>—Writes internal statistics to the log file.</li></ul></td></tr><tr><td>image</td><td><p>Display information about a PE file (executable or DLL).</p><p>Usage: <code>cytool image &#x3C;filename></code> </p><p></p><p>For example:</p><pre><code><strong>C:\Program Files\Palo Alto Networks\Traps> cytool image json.dll 
+</strong>Image Information 
+Location: json.dll 
+Size: 176.98 KB (181224 bytes) 
+File SHA256: a46b8e1ad9a808fb09e7b79bd03b66a611d0c7aa71291c216be555af14d16421 
+Architecture: x86-64 
+Subsystem: Windows GUI 
+PE Size: 156.00 KB (159744 bytes) 
+PE SHA256: 8cbca46419bf7260c99aaa3c73a6944e97f5c5b053a8b88e9a17367439b08d7d
+</code></pre></td></tr><tr><td>imageprep</td><td><p>Prepare a golden image by submitting files for cloud analysis and generate a threats report.</p><p>Usage: <code>cytool imageprep [scan] [timeout &#x3C;scan timeout>][upload &#x3C;upload timeout>] [path &#x3C;full path>]</code></p><p>where:</p><ul><li><code>&#x3C;scan timeout></code>—The number of hours the scan is permitted to run before reporting an error.</li><li><code>&#x3C;upload timeout></code>—The number of minutes the agent can take to upload unknown files to Cortex XDR before reporting an error.</li><li><code>&#x3C;full path></code>—Path to store the scan report. If no path is specified, Cytool saves the scan report to the local Cytool directory. To save files to this folder, you must first disable service protection using the <code>cytool protect disable</code> command.</li></ul><p></p><p>For example:</p><pre><code><strong>C:\Program Files\Palo Alto Networks\Traps> cytool imageprep scan timeout 4 upload 60 path c:\report 
+</strong>Start Time : 17:56:46 
+Elapsed Time : 00:04:17 
+State : Running 
+Scanned Files : 5427 
+Suspicious Files : 0 
+Failed Files : 9 
+Volume Root Path : \\?\C:\ 
+Window Usage : 0 236 20000 
+Path : ...t\cache2\entries\9B982CE198BF046E6CCF25478920DDFD9E5842E5 
+
+Scan completed successfully 
+Complete report can be found at: C:\report\imageprep_2019-03-06_08-59-30.xml
+</code></pre></td></tr><tr><td>import</td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>info</td><td><p>Display general Cortex XDR agent information.</p><p>Usage: <code>cytool info [query]</code></p><ul><li>To display the agent version, run the <code>cytool info</code> command without any additional arguments.</li><li>To display additional details about the agent, such as the version of the default policy and the specific build number, add the query argument.</li></ul></td></tr><tr><td>isolate</td><td><p>Release endpoint from network isolation.</p><p>Usage: <code>cytool isolate stop</code></p></td></tr><tr><td>last_checkin</td><td><p>Display the time of the last successful check-in.</p><p>Usage: <code>cytool last_checkin</code></p></td></tr><tr><td>log</td><td><p>Set log level for the desired process/Generate support file archive.</p><p>Usage: <code>cytool log set_level &#x3C;log_level> &#x3C;Components|all></code></p><p>where:</p><p>&#x3C;log_level>—An integer value corresponding to the log level:</p><ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul><p>&#x3C;Components> can be <code>cyserver</code> or <code>all</code> </p><p></p><p>Use <code>cytool log collect</code> to generate a support file archive of all logs in a TGZ file.</p></td></tr><tr><td>payload_execution</td><td><p>Stop or query payload execution status. Relates to Live Terminal and script execution.</p><p>Usage:</p><ul><li><code>cytool payload_execution query</code>—Displays current payload execution status.</li><li><code>cytool payload_execution stop</code>—Stops payload execution.</li></ul></td></tr><tr><td>persist</td><td><p>The Cortex XDR agent stores policy and security event information, such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <code>cytool persist &#x3C;action></code></p><p>Where &#x3C;action> can be:</p><ul><li><code>list</code>—Lists the local databases on the endpoint.</li><li><code>export [&#x3C;database name> | &#x3C;databasepath>]</code>—Exports the database table to a file in the <code>C:\Users\&#x3C;user>\Documents\PaloAltoNetworks\Traps\cytool</code> directory.</li><li><code>import [&#x3C;database name> | &#x3C;databasepath>]</code> &#x3C;file name>—Adds the records in a JSON file to the database.</li><li><code>print &#x3C;database name> | &#x3C;databasepath> [csv]</code>—Prints the records in the database to a CSV file.</li></ul><p>To view a list of all local databases, use the <code>cytool persist list</code> command.</p></td></tr><tr><td>policy</td><td><p>Query or compare the applied policy for a process.</p><p>Usage: <code>cytool policy [query | compare] [process [process]]</code></p><p>where:</p><ul><li><p>Options are:</p><p><code>query</code>—Displays the current applied policy for the process.</p><p><code>compare</code> —Compares the policy against the policy for another process, or against the default policy.</p></li><li><code>&#x3C;process></code>—Either the process name or process ID (PID).</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong>: </p><p>If an image name is specified, a new policy is generated as if the process was created. If a process ID is specified, the system queries the effective policy for the running process.</p></div><p></p><p>For example:</p><p>To query the policy for future executions of notepad.exe:</p><pre><code><strong>C:\Program Files\Palo Alto Networks\Traps> cytool policy query notepad.exe
+</strong>Enter supervisor password:
+
+Generic
+  Enable         0x00000001
+  LongHooks                     0x00000000
+  StaticHooks                   0x00000000
+  NoCallSplitting               0x00000000
+  InitSecurityCookie            0x00000000
+  DontInjectThinApp             0x00000001
+  LeanInjection                 0x00000000
+
+B01
+  Enable                        0x00000000
+  BlockAPI                      0x00000000
+[...]
+</code></pre><p>To compare the policy for future executions of notepad.exe to the default policy:</p><pre><code><strong>C:\Program Files\Palo Alto Networks\Traps> cytool policy compare notepad.exe default
+</strong>Enter supervisor password:
+
+Generic
+  Enable                            0x00000001                 0x00000001
+  LongHooks                         0x00000000                 0x00000000
+  StaticHooks                       0x00000000                 0x00000000
+  NoCallSplitting                   0x00000000                 0x00000000
+  InitSecurityCookie                0x00000000                 0x00000000
+  DontInjectThinApp                 0x00000001                 0x00000001
+  LeanInjection                     0x00000000                 0x00000000
+
+B01
+  Enable                            0x00000000                 0x00000000
+  BlockAPI                          0x00000000                 0x00000000
+[...]
+</code></pre><p><code>cytool policy query 1337</code></p><p>Query the policy of process with ID 1337.</p><p><code>cytool policy compare notepad.exe 1337</code></p><p>Compare notepad's and process ID 1337 policies.</p></td></tr><tr><td>protect</td><td><p>Enable or disable a protection feature.</p><p>Usage: cytool protect <code>&#x3C;Action></code> <code>&#x3C;Feature></code></p><p>where:</p><ul><li><p>&#x3C;Action>—Changes protection for an agent feature. Options are:</p><p><code>enable</code></p><p><code>disable</code></p><p><code>policy</code></p><p><code>query</code></p><p>The query option displays the protection status for each feature.</p></li><li><p>&#x3C;Feature>—Specifies the feature for which you want to change the protection status. Options are:</p><p><code>Process</code>, for agent core processes</p><p><code>Registry</code>, for agent registry keys</p><p><code>File</code>, for agent files</p><p><code>Service</code>, for agent services</p><p><code>Pipe</code>, for protection of agent pipes.</p></li></ul><p></p><p>For example:</p><p>To disable registry protection,</p><p><code>cytool protect disable registry</code></p><p>To enable all protection,</p><p><code>cytool protect enable</code></p><p>To set protection according to policy,</p><p><code>cytool protect policy</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Any protection state change made by Cytool persists until the next reboot and is set according to the policy one hour after reboot.</p></div></td></tr><tr><td>proxy</td><td><p>Set or query cloud-defined proxies for the agent.</p><p>Usage:</p><ul><li><code>cytool proxy query</code>—Displays the current status of cloud-defined proxy settings.</li><li><p><code>cytool proxy set &#x3C;list></code>—Sets cloud-defined proxy settings to the proxies defined in &#x3C;list>.</p><p>For example: <code>cytool proxy set "192.168.50.1:8080,192.168.60.2:808"</code></p></li><li><code>cytool proxy set ""</code>—Disables cloud-defined proxy.</li></ul></td></tr><tr><td>quarantine</td><td><p>View and restore quarantined files.</p><p>Usage:</p><ul><li><code>cytool quarantine list</code>—Lists all quarantined files.</li><li><code>cytool restore &#x3C;ID> [&#x3C;path>]</code>—Restores files to their original location or to a path, if specified, by specifying the file ID.</li></ul></td></tr><tr><td>queryall</td><td>Display a list of imported certificates for troubleshooting purposes.</td></tr><tr><td>reconnect</td><td><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div></td></tr><tr><td>runtime</td><td><p></p><p>Stop or start product components.</p><p>Usage: <code>cytool runtime &#x3C;Action> &#x3C;Component></code></p><p>where:</p><ul><li><p>&#x3C;Action>—Changes startup runtime action for an agent component.</p><p>Options are: <code>start</code>, <code>stop</code>, and <code>query</code>. The query option displays the startup status for each component.</p></li><li><p>&#x3C;Component>—Specifies the component for which you want to change the runtime action, or you can specify all components by not including any in this command.</p><p>To change the runtime action for a subset of components, list them with spaces separating each component.</p><p>Options are: <code>cyverak</code>, <code>cyvrmtgn</code>, <code>cyvrfsfd</code>, and <code>cyserver</code>.</p></li></ul><p>For example:</p><pre><code><strong>C:\Program Files\Palo Alto Networks\Traps>cytool runtime stop cyserver cyverak
+</strong>Enter supervisor password:
+
+Service         State
+cyverak         Stopped
+cyvrmtgn        Running
+cyvrfsfd        Running
+cyserver        Stopped
+</code></pre></td></tr><tr><td>scan</td><td><p>Scan operations.</p><p>Usage: <code>cytool scan &#x3C;Action></code></p><p>Where &#x3C;action>:</p><ul><li><code>start</code>—Scans the endpoint for malware.</li><li><code>stop</code>—Stops a scan.</li><li><code>query</code>—Displays the progress if a system scan is active.</li><li><code>last_scan_time</code>—Displays the last time a scan was done.</li></ul><p>Example:</p><pre><code><strong>C:\Program Files\Palo Alto Networks\Traps> cytool scan start
+</strong>Enter supervisor password:
+
+The operation completed successfully.
+
+<strong>C:\Program Files\Palo Alto Networks\Traps> cytool scan query 
+</strong>Enter supervisor password:
+
+Start Time       : 9:09:0648
+Elapsed Time     : 00:00:51
+State            : Running
+Scanned Files    : 3944
+Suspicious Files : 0
+Failed Files     : 1\?\C:\
+Volume Root Path : \\?\C:\                                      8                                            20000
+Window Usage     : 0                                           14                                            20000
+Path             : ...
+</code></pre></td></tr></tbody></table>

▸ Create and manage cloud security rules modified +1 −1 The Attack path rule type was renamed Attack Path (Legacy) in the rule types table. xsiam/cloud-security/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -11,13 +11,13 @@ You can create your own custom rules to use them in custom cloud security polici

Rule type│Description

| ---------------------- | ------------------------------------------------------------------------------------------------------------------- |

| ---------------------- | ------------------------------------------------------------------------------------------------------------------- |

Graph│Graph rules leverage graph queries to monitor your environment for complex attack paths and potential breach paths.

Configuration (Config)│Configuration rules monitor your resource configurations for potential policy violations.

Data│Data rules protect against malware and enable data classification.

Identity│Identity rules monitor the identities in your cloud environment for excess or unused permissions.

Network Exposure│Network exposure rules detect assets exposed to the internet.

AI│AI rules monitor your AI ecosystem for risks and misconfigurations.

Attack path│Attack path rules monitor the high risk attack paths for possible breaches.

Attack Path (Legacy)│Attack path rules monitor the high risk attack paths for possible breaches.

You can view and manage cloud posture security rules from the Posture Management → Rules & Policies → Rules → Cloud Security page.

Show markdown source

@@ -11,13 +11,13 @@ You can create your own custom rules to use them in custom cloud security polici
 | **Rule type**          | **Description**                                                                                                     |
 | ---------------------- | ------------------------------------------------------------------------------------------------------------------- |
 | Graph                  | Graph rules leverage graph queries to monitor your environment for complex attack paths and potential breach paths. |
 | Configuration (Config) | Configuration rules monitor your resource configurations for potential policy violations.                           |
 | Data                   | Data rules protect against malware and enable data classification.                                                  |
 | Identity               | Identity rules monitor the identities in your cloud environment for excess or unused permissions.                   |
 | Network Exposure       | Network exposure rules detect assets exposed to the internet.                                                       |
 | AI                     | AI rules monitor your AI ecosystem for risks and misconfigurations.                                                 |
-| Attack path            | Attack path rules monitor the high risk attack paths for possible breaches.                                         |
+| Attack Path (Legacy)   | Attack path rules monitor the high risk attack paths for possible breaches.                                         |
 
 You can view and manage cloud posture security rules from the **Posture Management** → **Rules & Policies** → **Rules** → **Cloud Security** page.
 
 <br>

▸ Create an attack path (legacy) rule modified +1 −1 Retitled Create an attack path (legacy) rule; the path and the procedure are unchanged. xsiam/cloud-security/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-attack-path-rule

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,15 +1,15 @@

---

description: >-

Create Cortex XSIAM attack path rules that identify breach paths to high-value

cloud assets.

---

# Create an attack path rule

# Create an attack path (legacy) rule

Attack path rules identify critical risks arising from combinations of individual risk signals—such as overly permissive identities, network exposures, and exploitable vulnerabilities—that together form a potential breach path to high-value assets.

Legacy attack path rules are based on discovering combinations and findings. We recommend using Graph rules for analyzing relationships between entities to identify risky combinations and attack paths.

Perform these steps to create a custom attack path rule:

1. Navigate to Posture Management → Rules & Policies → Rules → Cloud Security.

Show markdown source

@@ -1,15 +1,15 @@
 ---
 description: >-
   Create Cortex XSIAM attack path rules that identify breach paths to high-value
   cloud assets.
 ---
 
-# Create an attack path rule
+# Create an attack path (legacy) rule
 
 Attack path rules identify critical risks arising from combinations of individual risk signals—such as overly permissive identities, network exposures, and exploitable vulnerabilities—that together form a potential breach path to high-value assets.
 
 Legacy attack path rules are based on discovering combinations and findings. We recommend using [Graph rules](create-a-graph-rule) for analyzing relationships between entities to identify risky combinations and attack paths.
 
 Perform these steps to create a custom attack path rule:
 
 1. Navigate to **Posture Management** → **Rules & Policies** → **Rules** → **Cloud Security**.

▸ Cortex Cloud AI Security modified +1 −1 xsiam/cloud-security/cortex-cloud-ai-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,11 +1,11 @@

---

description: >-

Explore Cortex Cloud AI Security in Cortex XSIAM for AI asset discovery, risk

Explore Cloud AI Security in Cortex XSIAM for AI asset discovery, risk

detection, and security investigations.

---

# Cortex Cloud AI Security

Cloud AI Security provides a comprehensive overview of the AI assets within an organization. It is designed to ensure AI security by offering tools to review and prioritize AI risks effectively.

Show markdown source

@@ -1,11 +1,11 @@
 ---
 description: >-
-  Explore Cortex Cloud AI Security in Cortex XSIAM for AI asset discovery, risk
+  Explore Cloud AI Security in Cortex XSIAM for AI asset discovery, risk
   detection, and security investigations.
 ---
 
 # Cortex Cloud AI Security
 
 Cloud AI Security provides a comprehensive overview of the AI assets within an organization. It is designed to ensure AI security by offering tools to review and prioritize AI risks effectively.
 
 ***

▸ Cortex Cloud AI Security concepts modified +3 −3 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-ai-security-concepts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,18 +1,18 @@

---

description: >-

Learn Cortex Cloud AI Security concepts in Cortex XSIAM, including AI assets,

Learn Cloud AI Security concepts in Cortex XSIAM, including AI assets, risks,

risks, and findings.

and findings.

---

# Cortex Cloud AI Security concepts

hint info

This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

endhint

#### Introduction to AI applications

The AI application ecosystem comprises several critical components that work together to enable the functionality of AI-driven applications. The following explains the main concepts and shows some examples.

Show markdown source

@@ -1,18 +1,18 @@
 ---
 description: >-
-  Learn Cortex Cloud AI Security concepts in Cortex XSIAM, including AI assets,
-  risks, and findings.
+  Learn Cloud AI Security concepts in Cortex XSIAM, including AI assets, risks,
+  and findings.
 ---
 
 # Cortex Cloud AI Security concepts
 
 {% hint style="info" %}
-This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
+Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
 {% endhint %}
 
 #### Introduction to AI applications
 
 The AI application ecosystem comprises several critical components that work together to enable the functionality of AI-driven applications. The following explains the main concepts and shows some examples.
 
 <details>

▸ Cortex Cloud AI Security use cases modified +9 −9 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-ai-security-use-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,18 +1,18 @@

---

description: >-

Explore Cortex Cloud AI Security use cases in Cortex XSIAM for discovering,

Explore Cloud AI Security use cases in Cortex XSIAM for discovering,

assessing, and securing AI systems.

---

# Cortex Cloud AI Security use cases

hint info

This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

endhint

#### Understand your AI ecosystem

Understanding your AI ecosystem is crucial for identifying potential vulnerabilities and ensuring the robustness of your AI operations. A comprehensive view of your AI landscape helps in pinpointing where sensitive data is processed and stored, as well as how data flows between systems.

To understand your AI ecosystem, use the AI Security Dashboard, which provides visibility into all the AI components. You can also see how your AI assets relate to any other asset in the environment using the Graph Search. The complete list of your AI assets can be found under AI Inventory, where you can investigate each asset.

@@ -21,35 +21,35 @@ To understand your AI ecosystem, use the **AI Security Dashboard**, which provid

To understand a specific component of your AI ecosystem and identify any findings or security issues related to it, use its asset card and links to findings, issues, and cases created for the asset. When you select an asset, you can review all the tabs on its asset card. These tabs on the asset cards provide information about the following: overview, access, data, vulnerabilities, applications, and AI ecosystems.

#### Detect AI security issues

Detecting the AI security issues early is pivotal to safeguarding AI-powered applications and the sensitive data they handle. AI systems, due to their complexity, can often be opaque, making it difficult to identify vulnerabilities using traditional methods. To detect security issues in your AI ecosystem, use the AI Security Issues page.

#### Secure the data for AI

Securing the data utilized by AI systems is critical. Cortex Cloud AI Security helps you identify the data that is impacted by your AI ecosystem, whether it's training data, data used for RAG (Retrieval Augmented Generation) or any other related data such as prompt logs. It also classifies this data, using Cortex Cloud Data Security. Data classification across your AI ecosystem allows you to identify models that are trained on sensitive data and to prioritize all identified risks and issues based on their data impact. For example, missing guardrails on a sensitive model should be treated differently due to its context.

Securing the data utilized by AI systems is critical. Cloud AI Security helps you identify the data that is impacted by your AI ecosystem, whether it's training data, data used for RAG (Retrieval Augmented Generation) or any other related data such as prompt logs. It also classifies this data, using Cortex Cloud Data Security. Data classification across your AI ecosystem allows you to identify models that are trained on sensitive data and to prioritize all identified risks and issues based on their data impact. For example, missing guardrails on a sensitive model should be treated differently due to its context.

#### Discover self-managed AI models

Cortex Cloud AI Security helps organizations discover self-managed AI models.

Cloud AI Security helps organizations discover self-managed AI models.

Self-managed AI models refer to AI models that are deployed and operated on self-managed cloud infrastructure, rather than through cloud providers' managed services. These models are often sourced from public repositories like Hugging Face, and can lead to the proliferation of shadow AI.

The growing use of AI in business workflows makes it increasingly important to manage and secure all AI models, whether deployed through managed services or self-managed infrastructures. Self-managed AI models, in particular, introduce unique risks, such as security vulnerabilities and compliance gaps. Tracking and securing these models is essential to reducing risks and ensuring that AI applications remain safe, secure, and compliant.

#### Comply with AI regulations

Cortex Cloud AI Security ensures compliance with emerging AI mandates and industry standards, which is crucial because new frameworks require unique measures to govern AI-specific vulnerabilities. For example, data poisoning is a major risk for AI applications but traditional compliance programs are not designed to handle it; however, new frameworks for AI governance include relevant measures, such as the documentation of data sources used to train AI models. In addition, AI-powered applications also add complexity for existing regulations like GDPR, due to their data processing and interconnected systems.

Cloud AI Security ensures compliance with emerging AI mandates and industry standards, which is crucial because new frameworks require unique measures to govern AI-specific vulnerabilities. For example, data poisoning is a major risk for AI applications but traditional compliance programs are not designed to handle it; however, new frameworks for AI governance include relevant measures, such as the documentation of data sources used to train AI models. In addition, AI-powered applications also add complexity for existing regulations like GDPR, due to their data processing and interconnected systems.

Cortex Cloud AI Security allows for continuous monitoring and visualization of compliance with leading AI standards, such as the OWASP Top Ten for LLM.

Cloud AI Security allows for continuous monitoring and visualization of compliance with leading AI standards, such as the OWASP Top Ten for LLM.

Complying with current industry standards can help shorten the time needed to meet future binding regulations. Cortex Cloud AI Security helps you enforce policies, maintain audit trails, and achieve compliance, providing visibility into compliance violations and helping manage your AI Inventory, which is essential for controlling model sprawl and shadow AI.

Complying with current industry standards can help shorten the time needed to meet future binding regulations. Cloud AI Security helps you enforce policies, maintain audit trails, and achieve compliance, providing visibility into compliance violations and helping manage your AI Inventory, which is essential for controlling model sprawl and shadow AI.

#### Manage your AI software supply chain

As AI becomes deeply embedded in application development, security teams need comprehensive visibility into the software supply chain. This visibility must go beyond deployed AI models and agents, extending to the underlying AI software packages and SDKs that developers use to build these systems.

A key aspect of Cortex Cloud AI Security is implementing a shift-left approach to AI security. This helps organizations identify and manage risks early in the development lifecycle by providing visibility into the AI software supply chain. Understanding this supply chain is crucial for both generating an AI Bill of Materials (AI-BOM) and for identifying potential vulnerabilities before they are deployed to production. This proactive stance ensures that security is addressed at the source, preventing more complex and costly issues later on.

A key aspect of Cloud AI Security is implementing a shift-left approach to AI security. This helps organizations identify and manage risks early in the development lifecycle by providing visibility into the AI software supply chain. Understanding this supply chain is crucial for both generating an AI Bill of Materials (AI-BOM) and for identifying potential vulnerabilities before they are deployed to production. This proactive stance ensures that security is addressed at the source, preventing more complex and costly issues later on.

#### Detect open-source models

Cortex Cloud AI Security provides detection and risk assessment for open-source models, identifying and displaying the count of open-source models on the dashboard.

Cloud AI Security provides detection and risk assessment for open-source models, identifying and displaying the count of open-source models on the dashboard.

Show markdown source

@@ -1,18 +1,18 @@
 ---
 description: >-
-  Explore Cortex Cloud AI Security use cases in Cortex XSIAM for discovering,
+  Explore Cloud AI Security use cases in Cortex XSIAM for discovering,
   assessing, and securing AI systems.
 ---
 
 # Cortex Cloud AI Security use cases
 
 {% hint style="info" %}
-This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
+Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
 {% endhint %}
 
 #### Understand your AI ecosystem
 
 Understanding your AI ecosystem is crucial for identifying potential vulnerabilities and ensuring the robustness of your AI operations. A comprehensive view of your AI landscape helps in pinpointing where sensitive data is processed and stored, as well as how data flows between systems.
 
 To understand your AI ecosystem, use the **AI Security Dashboard**, which provides visibility into all the AI components. You can also see how your AI assets relate to any other asset in the environment using the **Graph Search**. The complete list of your AI assets can be found under **AI Inventory**, where you can investigate each asset.
 
@@ -21,35 +21,35 @@ To understand your AI ecosystem, use the **AI Security Dashboard**, which provid
 To understand a specific component of your AI ecosystem and identify any findings or security issues related to it, use its asset card and links to findings, issues, and cases created for the asset. When you select an asset, you can review all the tabs on its asset card. These tabs on the asset cards provide information about the following: overview, access, data, vulnerabilities, applications, and AI ecosystems.
 
 #### Detect AI security issues
 
 Detecting the AI security issues early is pivotal to safeguarding AI-powered applications and the sensitive data they handle. AI systems, due to their complexity, can often be opaque, making it difficult to identify vulnerabilities using traditional methods. To detect security issues in your AI ecosystem, use the **AI Security Issues** page.
 
 #### Secure the data for AI
 
-Securing the data utilized by AI systems is critical. Cortex Cloud AI Security helps you identify the data that is impacted by your AI ecosystem, whether it's training data, data used for RAG (Retrieval Augmented Generation) or any other related data such as prompt logs. It also classifies this data, using Cortex Cloud Data Security. Data classification across your AI ecosystem allows you to identify models that are trained on sensitive data and to prioritize all identified risks and issues based on their data impact. For example, missing guardrails on a sensitive model should be treated differently due to its context.
+Securing the data utilized by AI systems is critical. Cloud AI Security helps you identify the data that is impacted by your AI ecosystem, whether it's training data, data used for RAG (Retrieval Augmented Generation) or any other related data such as prompt logs. It also classifies this data, using Cortex Cloud Data Security. Data classification across your AI ecosystem allows you to identify models that are trained on sensitive data and to prioritize all identified risks and issues based on their data impact. For example, missing guardrails on a sensitive model should be treated differently due to its context.
 
 #### Discover self-managed AI models
 
-Cortex Cloud AI Security helps organizations discover self-managed AI models.
+Cloud AI Security helps organizations discover self-managed AI models.
 
 Self-managed AI models refer to AI models that are deployed and operated on self-managed cloud infrastructure, rather than through cloud providers' managed services. These models are often sourced from public repositories like Hugging Face, and can lead to the proliferation of shadow AI.
 
 The growing use of AI in business workflows makes it increasingly important to manage and secure all AI models, whether deployed through managed services or self-managed infrastructures. Self-managed AI models, in particular, introduce unique risks, such as security vulnerabilities and compliance gaps. Tracking and securing these models is essential to reducing risks and ensuring that AI applications remain safe, secure, and compliant.
 
 #### Comply with AI regulations
 
-Cortex Cloud AI Security ensures compliance with emerging AI mandates and industry standards, which is crucial because new frameworks require unique measures to govern AI-specific vulnerabilities. For example, data poisoning is a major risk for AI applications but traditional compliance programs are not designed to handle it; however, new frameworks for AI governance include relevant measures, such as the documentation of data sources used to train AI models. In addition, AI-powered applications also add complexity for existing regulations like GDPR, due to their data processing and interconnected systems.
+Cloud AI Security ensures compliance with emerging AI mandates and industry standards, which is crucial because new frameworks require unique measures to govern AI-specific vulnerabilities. For example, data poisoning is a major risk for AI applications but traditional compliance programs are not designed to handle it; however, new frameworks for AI governance include relevant measures, such as the documentation of data sources used to train AI models. In addition, AI-powered applications also add complexity for existing regulations like GDPR, due to their data processing and interconnected systems.
 
-Cortex Cloud AI Security allows for continuous monitoring and visualization of compliance with leading AI standards, such as the OWASP Top Ten for LLM.
+Cloud AI Security allows for continuous monitoring and visualization of compliance with leading AI standards, such as the OWASP Top Ten for LLM.
 
-Complying with current industry standards can help shorten the time needed to meet future binding regulations. Cortex Cloud AI Security helps you enforce policies, maintain audit trails, and achieve compliance, providing visibility into compliance violations and helping manage your AI Inventory, which is essential for controlling model sprawl and shadow AI.
+Complying with current industry standards can help shorten the time needed to meet future binding regulations. Cloud AI Security helps you enforce policies, maintain audit trails, and achieve compliance, providing visibility into compliance violations and helping manage your AI Inventory, which is essential for controlling model sprawl and shadow AI.
 
 #### Manage your AI software supply chain
 
 As AI becomes deeply embedded in application development, security teams need comprehensive visibility into the software supply chain. This visibility must go beyond deployed AI models and agents, extending to the underlying AI software packages and SDKs that developers use to build these systems.
 
-A key aspect of Cortex Cloud AI Security is implementing a shift-left approach to AI security. This helps organizations identify and manage risks early in the development lifecycle by providing visibility into the AI software supply chain. Understanding this supply chain is crucial for both generating an AI Bill of Materials (AI-BOM) and for identifying potential vulnerabilities before they are deployed to production. This proactive stance ensures that security is addressed at the source, preventing more complex and costly issues later on.
+A key aspect of Cloud AI Security is implementing a shift-left approach to AI security. This helps organizations identify and manage risks early in the development lifecycle by providing visibility into the AI software supply chain. Understanding this supply chain is crucial for both generating an AI Bill of Materials (AI-BOM) and for identifying potential vulnerabilities before they are deployed to production. This proactive stance ensures that security is addressed at the source, preventing more complex and costly issues later on.
 
 #### Detect open-source models
 
-Cortex Cloud AI Security provides detection and risk assessment for open-source models, identifying and displaying the count of open-source models on the dashboard.
+Cloud AI Security provides detection and risk assessment for open-source models, identifying and displaying the count of open-source models on the dashboard.

▸ Cortex Cloud SaaS Security deleted +0 −36 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,36 +0,0 @@

---

description: >-

Use Cortex Cloud SaaS Security in Cortex XSIAM for continuous visibility and

control of SaaS identities, apps, and AI agents.

---

# Cortex Cloud SaaS Security

Software-as-a-Service (SaaS) environments optimize end-user workflows through rapid provisioning and native collaboration capabilities. However, this decentralized architecture presents a significant visibility challenge for cybersecurity.

Your security teams have to contend with the difficult task of managing this proliferation of both sanctioned and unsanctioned applications, while ensuring consistent cloud compliance and mitigating risks to critical information and users.

hint info

Note: SaaS Security is currently in Beta with limited availability. Contact your Customer Service Representative to activate SaaS Security in your environment.

endhint

SaaS Security offers a robust framework that:

• Delivers full visibility and governance over various shadow IT vulnerabilities.

• Defends cloud applications against both identified and emerging threats.

• Ensures data protection and compliance across the entire SaaS environment.

• Restricts corporate application access to authorized individuals only.

• Hardens AI agent deployments to mitigate risks like prompt injections and unauthorized data movement.

\

To deliver these outcomes, the platform utilizes the following pillars:

• Implement SaaS Security Checks for continuous oversight of security configurations.

• Apply SaaS Agent Security for automated enforcement and visibility of AI agents on platforms such as Salesforce and Microsoft Copilot.

• Deploy Data Security for deep inspection and remediation of at-rest assets within sanctioned environments.

• SaaS Identity Security gives you the tools to implement Zero Trust access controls to defend against malicious insiders and sophisticated threat actors.

• SaaS Threat Security proactively identifies anomalous behaviors and simplifies monitoring with user risk scores and predefined situational policies.

Show markdown source

@@ -1,36 +0,0 @@
----
-description: >-
-  Use Cortex Cloud SaaS Security in Cortex XSIAM for continuous visibility and
-  control of SaaS identities, apps, and AI agents.
----
-
-# Cortex Cloud SaaS Security
-
-Software-as-a-Service (SaaS) environments optimize end-user workflows through rapid provisioning and native collaboration capabilities. However, this decentralized architecture presents a significant visibility challenge for cybersecurity.
-
-Your security teams have to contend with the difficult task of managing this proliferation of both sanctioned and unsanctioned applications, while ensuring consistent cloud compliance and mitigating risks to critical information and users.
-
-<figure><img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FQBxyJ8Mv26SYFS7mYKn6%2Fsaas-horizontal-2.gif?alt=media&#x26;token=1d805f79-2814-40b5-b7ca-d50aa82ad41d" alt=""><figcaption></figcaption></figure>
-
-{% hint style="info" %}
-Note: SaaS Security is currently in Beta with limited availability. Contact your Customer Service Representative to activate SaaS Security in your environment.
-{% endhint %}
-
-SaaS Security offers a robust framework that:
-
-* Delivers full visibility and governance over various shadow IT vulnerabilities.
-* Defends cloud applications against both identified and emerging threats.
-* Ensures data protection and compliance across the entire SaaS environment.
-* Restricts corporate application access to authorized individuals only.
-* Hardens AI agent deployments to mitigate risks like prompt injections and unauthorized data movement.
-
-\
-To deliver these outcomes, the platform utilizes the following pillars:
-
-* Implement SaaS Security Checks for continuous oversight of security configurations.
-* Apply SaaS Agent Security for automated enforcement and visibility of AI agents on platforms such as Salesforce and Microsoft Copilot.
-* Deploy Data Security for deep inspection and remediation of at-rest assets within sanctioned environments.
-* SaaS Identity Security gives you the tools to implement Zero Trust access controls to defend against malicious insiders and sophisticated threat actors.
-* SaaS Threat Security proactively identifies anomalous behaviors and simplifies monitoring with user risk scores and predefined situational policies.
-
-<br>

▸ Create and monitor tickets deleted +0 −38 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/create-and-monitor-tickets

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,38 +0,0 @@

---

description: >-

Create and monitor synced remediation tickets for Cortex XSIAM SaaS Security

issues.

---

# Create and monitor tickets

Integrate SaaS Security with Jira or ServiceNow to streamline misconfiguration remediation. This integration allows security teams to delegate manual remediation tasks directly to SaaS application administrators using your organization's existing issue tracking system.

### Prerequisites

Before managing tickets from the SSPM console, ensure:

• An active Jira or ServiceNow instance is connected and authenticated within your tenant settings. Follow these steps to activate Issue Syncing.

### Ticket Management Workflows

####
Create a Ticket

When a SaaS Security issue requires manual intervention within a target SaaS application:

1. Open the target Issue in the Cortex console.

2. On the Overview page, select Jira under the issue properties. This takes you to the ticket’s sync settings.

3. Under Sync Configuration, select Bi-directional.

4. Assign the ticket to the appropriate team member or administrator for investigation and resolution.

Once created, SaaS Security automatically establishes a bi-directional reference linking the specific issue to the new ticket ID.

####
View Linked Tickets

You can track remediation progress directly from the SaaS interface:

• Select the highlighted ticket reference within any issue view to open the issue directly in Jira or ServiceNow.

Show markdown source

@@ -1,38 +0,0 @@
----
-description: >-
-  Create and monitor synced remediation tickets for Cortex XSIAM SaaS Security
-  issues.
----
-
-# Create and monitor tickets
-
-Integrate SaaS Security with Jira or ServiceNow to streamline misconfiguration remediation. This integration allows security teams to delegate manual remediation tasks directly to SaaS application administrators using your organization's existing issue tracking system.
-
-***
-
-### Prerequisites
-
-Before managing tickets from the SSPM console, ensure:
-
-* An active Jira or ServiceNow instance is connected and authenticated within your tenant settings. Follow these steps to activate [Issue Syncing](../../../detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-syncing).
-
-***
-
-### Ticket Management Workflows
-
-#### 1. Create a Ticket
-
-When a SaaS Security issue requires manual intervention within a target SaaS application:
-
-1. Open the target Issue in the Cortex console.
-2. On the **Overview** page, select Jira under the issue properties. This takes you to the ticket’s sync settings.
-3. Under **Sync Configuration**, select Bi-directional.
-4. Assign the ticket to the appropriate team member or administrator for investigation and resolution.
-
-Once created, SaaS Security automatically establishes a bi-directional reference linking the specific issue to the new ticket ID.
-
-#### 2. View Linked Tickets
-
-You can track remediation progress directly from the SaaS interface:
-
-* Select the highlighted ticket reference within any issue view to open the issue directly in Jira or ServiceNow.

▸ Detection Rules deleted +0 −17 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/detection-rules

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,17 +0,0 @@

---

description: >-

View Cortex XSIAM Cloud Security Posture Rules for SaaS application risk

detection.

---

# Detection Rules

Detection Rules help you identify policies that are already in place and available out-of-the-box to help you remediate configuration issues with SaaS applications. Follow the steps below to view SaaS Detection Rules.

1. Navigate to Modules > SaaS Security > Detection Rules. This takes you to the Cloud Posture Security Rules page.

2. Here you can select SaaS or AI > Filter In to see a full list of available out-of-the-box rules.

3. Select a Rule to view more details. Options include:

4. Rule Details: Displays a detailed description of the Rule and outlines execution scope.

5. Compliance Controls: Maps this rule's execution logic to framework controls (such as SOC 2, ISO 27001, or CIS Benchmarks) for compliance audits.

Show markdown source

@@ -1,17 +0,0 @@
----
-description: >-
-  View Cortex XSIAM Cloud Security Posture Rules for SaaS application risk
-  detection.
----
-
-# Detection Rules
-
-Detection Rules help you identify policies that are already in place and available out-of-the-box to help you remediate configuration issues with SaaS applications. Follow the steps below to view SaaS Detection Rules.
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2Fq32WuSgWAUXhh3Moe8N3%2Funknown.png?alt=media&#x26;token=929b18e2-458e-4a74-8712-85f5ba853ebe" alt="" height="312" width="624">
-
-1. Navigate to **Modules > SaaS Security > Detection Rules**. This takes you to the Cloud Posture Security Rules page.
-2. Here you can select **SaaS or AI > Filter In** to see a full list of available out-of-the-box rules.
-3. Select a Rule to view more details. Options include:
-4. **Rule Details**: Displays a detailed description of the Rule and outlines execution scope.
-5. **Compliance Controls**: Maps this rule's execution logic to framework controls (such as SOC 2, ISO 27001, or CIS Benchmarks) for compliance audits.

▸ Onboard a Supported SaaS Application deleted +0 −64 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,64 +0,0 @@

---

description: >-

Onboard supported SaaS applications to Cortex XSIAM for posture monitoring,

misconfiguration detection, and compliance visibility.

---

# Onboard a Supported SaaS Application

To detect posture risks, applications must first be connected to SaaS Security and have the necessary permissions to scan SaaS applications settings. During onboarding, SaaS Security prompts you for the configuration information required to establish a connection with the SaaS app. The configuration information that SaaS Security requires differs from app to app, and you might need to collect configuration information prior to onboarding.

When you onboard a SaaS app, SaaS Security may prompt you for information used to connect to the SaaS app, such as administrator credentials for a service account. The required information varies from app to app, and in many cases you must first take some actions on the SaaS app, such as creating an API key.

The following table provides links to detailed onboarding instructions for most applications. Where detailed instructions are not available for a particular SaaS application, the table includes the relevant onboarding steps.

### Available onboarding instructions

SaaS App Onboarding Instructions│Onboarding Steps

| ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Aha.io│-

Asana│-

Atlassian│-

Automox│-

BusinessMap│-

Celonis│-

Cisco Duo│-

Cisco Meraki│-

Clickup│-

Contentful│-

Couchbase│-

Coveo│-

Databricks│-

DataDog│-

Gainsight│-

Grammarly│-

Harness│-

Intercom│-

Jamf Pro│-

Jumpcloud│-

Kustomer│-

Microsoft Entra│-

Monday│-

MongoDB│-

Mulesoft│-

Mural│-

Nintex Workflow Cloud│

Complete the following steps to connect to a Nintex Workflow Cloud API:

Log in to a Nintex Workflow Cloud account that is assigned to the Global administrator role.
From the Apps and Tokens page in your Nintex Workflow Cloud settings, add an app.
Copy the Client ID and the Client Secret that is associated with your app.
During onboarding, provide the Client ID and the Client Secret that is associated with your app.

Office365│-

Okta│-

Pagerduty│-

Ping Identity│

Complete the following steps to enable to connect a Ping Identity API:

Log in to Ping Identity as an administrator assigned to either the Organization Admin or Environment Admin role.
Create a Ping Identity worker application, which will inherit your role assignments and enable access to the API. Copy the application's Client ID and Client Secret.
Copy your Environment ID and Region, which are shown on your environment page in Ping Identity.
During onboarding, provide the following information:
- The Client ID and Client Secret of the worker application
- Your Environment ID and Region

Pipedrive│

Complete the following steps to connect to a Pipedrive API:

Log in to Pipedrive as an administrator and copy the administrator's personal API token.
During onboarding , provide the API token.

Qualtrics│

Complete the following steps to enable configuration information access through an administrator account. Your organization must be using Okta as an identity provider. MFA using one-time passcodes must be configured.

Identify the Qualtrics XM administrator whose credentials you will supply to SSPM. The account must have Brand Administrator authority.
To enable SSPM to access the account using Okta credentials:
1. Identify your Okta subdomain.
2. Generate and copy an MFA secret key.
Identify your Organization ID. After you log in to Qualtrics XM, your organization ID is included in the Qualtrics XM URL. The URL format is <org-ID>.qualtrics.com.
Identify your SSO display name. To get the display name, go to AdminOrganization> SettingsSSO and open the Edit page for the SSO connection.
During onboarding, provide the information above.

Redis Labs│-

Salesforce│-

SAP Ariba│-

Sentryio│-

ServiceNow│-

Shopify│-

Slack│-

@@ diff truncated @@

Show markdown source

@@ -1,64 +0,0 @@
----
-description: >-
-  Onboard supported SaaS applications to Cortex XSIAM for posture monitoring,
-  misconfiguration detection, and compliance visibility.
----
-
-# Onboard a Supported SaaS Application
-
-To detect posture risks, applications must first be connected to SaaS Security and have the necessary permissions to scan SaaS applications settings. During onboarding, SaaS Security prompts you for the configuration information required to establish a connection with the SaaS app. The configuration information that SaaS Security requires differs from app to app, and you might need to collect configuration information prior to onboarding.
-
-When you onboard a SaaS app, SaaS Security may prompt you for information used to connect to the SaaS app, such as administrator credentials for a service account. The required information varies from app to app, and in many cases you must first take some actions on the SaaS app, such as creating an API key.
-
-The following table provides links to detailed onboarding instructions for most applications. Where detailed instructions are not available for a particular SaaS application, the table includes the relevant onboarding steps.
-
-### Available onboarding instructions
-
-| **SaaS App Onboarding Instructions**                                               | **Onboarding Steps**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Aha.io](onboard-a-supported-saas-application/onboard-aha.io)                      | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Asana](onboard-a-supported-saas-application/onboard-asana)                        | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Atlassian](onboard-a-supported-saas-application/onboard-atlassian)                | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Automox](onboard-a-supported-saas-application/onboard-automox)                    | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [BusinessMap](onboard-a-supported-saas-application/onboard-businessmap)            | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Celonis](onboard-a-supported-saas-application/onboard-celonis)                    | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Cisco Duo](onboard-a-supported-saas-application/onboard-cisco-duo)                | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Cisco Meraki](onboard-a-supported-saas-application/onboard-cisco-meraki)          | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Clickup](onboard-a-supported-saas-application/onboard-clickup)                    | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Contentful](onboard-a-supported-saas-application/onboard-contentful)              | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Couchbase](onboard-a-supported-saas-application/onboard-couchbase)                | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Coveo](onboard-a-supported-saas-application/onboard-coveo)                        | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Databricks](onboard-a-supported-saas-application/onboard-databricks)              | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [DataDog](onboard-a-supported-saas-application/onboard-datadog)                    | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Gainsight](onboard-a-supported-saas-application/onboard-gainsight-px)             | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Grammarly](onboard-a-supported-saas-application/onboard-grammarly)                | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Harness](onboard-a-supported-saas-application/onboard-harness)                    | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Intercom](onboard-a-supported-saas-application/onboard-intercom)                  | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Jamf Pro](onboard-a-supported-saas-application/onboard-jamf-pro)                  | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Jumpcloud](onboard-a-supported-saas-application/onboard-jumpcloud)                | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Kustomer](onboard-a-supported-saas-application/onboard-kustomer)                  | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Microsoft Entra](onboard-a-supported-saas-application/onboard-microsoft-entra-id) | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Monday](onboard-a-supported-saas-application/onboard-monday.com)                  | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [MongoDB](onboard-a-supported-saas-application/onboard-mongodb-atlas)              | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Mulesoft](onboard-a-supported-saas-application/onboard-mulesoft)                  | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Mural](onboard-a-supported-saas-application/onboard-mural)                        | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| Nintex Workflow Cloud                                                              | <p>Complete the following steps to connect to a Nintex Workflow Cloud API:</p><ol><li>Log in to a Nintex Workflow Cloud account that is assigned to the Global administrator role.</li><li>From the Apps and Tokens page in your Nintex Workflow Cloud settings, add an app.</li><li>Copy the Client ID and the Client Secret that is associated with your app.</li><li>During onboarding, provide the Client ID and the Client Secret that is associated with your app.</li></ol>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| [Office365](onboard-a-supported-saas-application/onboard-office-365)               | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Okta](onboard-a-supported-saas-application/onboard-okta)                          | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Pagerduty](onboard-a-supported-saas-application/onboard-pagerduty)                | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| Ping Identity                                                                      | <p>Complete the following steps to enable to connect a Ping Identity API:</p><ol><li>Log in to Ping Identity as an administrator assigned to either the Organization Admin or Environment Admin role.</li><li>Create a Ping Identity worker application, which will inherit your role assignments and enable access to the API. Copy the application's Client ID and Client Secret.</li><li>Copy your Environment ID and Region, which are shown on your environment page in Ping Identity.</li><li><p>During onboarding, provide the following information:</p><ul><li>The Client ID and Client Secret of the worker application</li><li>Your Environment ID and Region</li></ul></li></ol>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| Pipedrive                                                                          | <p>Complete the following steps to connect to a Pipedrive API:</p><ol><li>Log in to Pipedrive as an administrator and copy the administrator's personal API token.</li><li>During onboarding , provide the API token.</li></ol>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| Qualtrics                                                                          | <p>Complete the following steps to enable configuration information access through an administrator account. Your organization must be using Okta as an identity provider. MFA using one-time passcodes must be configured.</p><ol><li>Identify the Qualtrics XM administrator whose credentials you will supply to SSPM. The account must have Brand Administrator authority.</li><li><p>To enable SSPM to access the account using Okta credentials:</p><ol><li><a href="https://docs.paloaltonetworks.com/content/techdocs/en_US/saas-security/sspm/onboard-saas-apps-supported-by-sspm/onboarding-an-app-using-okta-credentials.html#onboarding-an-app-using-okta-credentials_id-okta-subdomain">Identify your Okta subdomain</a>.</li><li><a href="https://docs.paloaltonetworks.com/content/techdocs/en_US/saas-security/sspm/onboard-saas-apps-supported-by-sspm/onboarding-an-app-using-okta-credentials.html#onboarding-an-app-using-okta-credentials_okta-gen-mfa-key">Generate and copy an MFA secret key</a>.</li></ol></li><li>Identify your Organization ID. After you log in to Qualtrics XM, your organization ID is included in the Qualtrics XM URL. The URL format is &#x3C;org-ID>.qualtrics.com.</li><li>Identify your SSO display name. To get the display name, go to AdminOrganization> SettingsSSO and open the Edit page for the SSO connection.</li><li>During onboarding, provide the information above.</li></ol> |
-| [Redis Labs](onboard-a-supported-saas-application/onboard-redis-labs)              | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Salesforce](onboard-a-supported-saas-application/onboard-salesforce)              | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [SAP Ariba](onboard-a-supported-saas-application/onboard-sap-ariba)                | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Sentryio](onboard-a-supported-saas-application/onboard-sentry)                    | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [ServiceNow](onboard-a-supported-saas-application/onboard-servicenow)              | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Shopify](onboard-a-supported-saas-application/onboard-shopify)                    | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Slack](onboard-a-supported-saas-application/onboard-slack-enterprise)             | -                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
@@ diff truncated @@

▸ Onboard Aha.io deleted +0 −55

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-aha.io

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,55 +0,0 @@

---

description: >-

Onboard Aha.io to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Aha.io

For SaaS Security to detect posture risks in your Aha.io instance, you must onboard your Aha.io instance to SaaS Security. Through the onboarding process, SaaS Security logs in to Aha.io using administrator account credentials. This account is used to scan your Aha.io instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

SaaS Security gets access to your Aha.io instance by using Okta SSO or Microsoft Azure credentials that you provide during the onboarding process. For this reason, your organization must be using Okta or Microsoft Azure as an identity provider. The Okta or Microsoft Azure account must be configured for multi-factor authentication (MFA) using one-time passcodes.

\

To onboard your Aha.io instance, you complete the following actions:

1. Collect information for accessing your Aha.io instance.

To access your Aha.io instance, you will need the following information, which you will specify during the onboarding process:

• User email: The login email address of the account that SSPM will use to access your Aha.io instance. Required Permissions: The user account must be assigned to both the Account and Billing administrator roles in Aha.io.

• Password: The password for the login account.

• Instance Host: The custom domain for accessing your organization's Aha.io account. You specify this domain when you sign up for an Aha.io account, and it is included as part of the URL that you use to access the account.

If you're logging in through Okta, you must provide SaaS Security with the following additional information:

• Okta subdomain: The Okta subdomain for your organization. The subdomain was included in the login URL that Okta assigned to your organization.

• Okta 2FA secret: A key that is used to generate one-time passcodes for MFA.

If you're using Azure Active Directory (AD) as your identity provider, you must provide SSPM with the following additional information:

• Azure 2FA secret: A key that is used to generate one-time passcodes for MFA.

As you complete the following steps, make note of the values of the items described in the preceding tables. You will need to enter these values during onboarding to access your Aha.io instance from SaaS Security.

2. Identify the Okta user account that SaaS Security will use to access your Aha.io instance. The user account must be assigned to both the Account and Billing administrator roles in Aha.io.

3. Get a secret key for MFA. The steps you follow to get the MFA secret key differ depending on the identity provider you're using to access the account.

4. (For Okta log in) To access the account through Okta:

1. Identify your Okta subdomain.

2. Generate and copy an MFA secret key.

5. (For Microsoft Azure log in) To access the account through Microsoft Azure:

1. Enable third-party software OATH tokens for the administrator account.

2. Configure the account for MFA and copy the MFA secret key.

3. Make note of your organization's Aha.io instance host name.

After you log in to Aha.io, the instance host name is a unique subdomain included in the Aha.io URL. The URL format is <instance_host>.aha.io.

4. Connect SaaS Security to your Aha.io instance.

1. Log in to Cortex.

2. Select Modules > SaaS Security > Add Data Source. You can use the Search bar to find the app you wish to connect to.

3. Click the Aha.io tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, provide the Tenant ID, Client ID, and Client Secret.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,55 +0,0 @@
----
-description: >-
-  Onboard Aha.io to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Aha.io
-
-For SaaS Security to detect posture risks in your Aha.io instance, you must onboard your [Aha.io](http://aha.io) instance to SaaS Security. Through the onboarding process, SaaS Security logs in to Aha.io using administrator account credentials. This account is used to scan your Aha.io instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-SaaS Security gets access to your Aha.io instance by using Okta SSO or Microsoft Azure credentials that you provide during the onboarding process. For this reason, your organization must be using Okta or Microsoft Azure as an identity provider. The Okta or Microsoft Azure account must be configured for multi-factor authentication (MFA) using one-time passcodes.
-
-\
-To onboard your Aha.io instance, you complete the following actions:
-
-1. Collect information for accessing your Aha.io instance.
-
-To access your Aha.io instance, you will need the following information, which you will specify during the onboarding process:
-
-* User email: The login email address of the account that SSPM will use to access your Aha.io instance. Required Permissions: The user account must be assigned to both the Account and Billing administrator roles in Aha.io.
-* Password: The password for the login account.
-* Instance Host: The custom domain for accessing your organization's Aha.io account. You specify this domain when you sign up for an Aha.io account, and it is included as part of the URL that you use to access the account.
-
-If you're logging in through Okta, you must provide SaaS Security with the following additional information:
-
-* Okta subdomain: The Okta subdomain for your organization. The subdomain was included in the login URL that Okta assigned to your organization.
-* Okta 2FA secret: A key that is used to generate one-time passcodes for MFA.
-
-If you're using Azure Active Directory (AD) as your identity provider, you must provide SSPM with the following additional information:
-
-* Azure 2FA secret: A key that is used to generate one-time passcodes for MFA.
-
-As you complete the following steps, make note of the values of the items described in the preceding tables. You will need to enter these values during onboarding to access your Aha.io instance from SaaS Security.
-
-2. Identify the Okta user account that SaaS Security will use to access your Aha.io instance. The user account must be assigned to both the Account and Billing administrator roles in Aha.io.
-3. Get a secret key for MFA. The steps you follow to get the MFA secret key differ depending on the identity provider you're using to access the account.
-4. (For Okta log in) To access the account through Okta:
-   1. Identify your Okta subdomain.
-   2. Generate and copy an MFA secret key.
-5. (For Microsoft Azure log in) To access the account through Microsoft Azure:
-   1. Enable third-party software OATH tokens for the administrator account.
-   2. Configure the account for MFA and copy the MFA secret key.
-   3. Make note of your organization's Aha.io instance host name.
-
-After you log in to Aha.io, the instance host name is a unique subdomain included in the Aha.io URL. The URL format is \<instance\_host>.aha.io.
-
-4. Connect SaaS Security to your Aha.io instance.
-   1. Log in to Cortex.
-   2. Select **Modules > SaaS Security > Add Data Source**. You can use the Search bar to find the app you wish to connect to.
-   3. Click the Aha.io tile.
-   4. Under **Capabilities**, Enter a Name for your application.
-   5. Select Security Posture under Default Capabilities and click Next.
-   6. Under **Connections**, provide the Tenant ID, Client ID, and Client Secret.
-   7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-   8. Click **Next** to complete the onboarding validation process.

▸ Onboard Asana deleted +0 −69

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-asana

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,69 +0,0 @@

---

description: >-

Onboard Asana to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Asana

For SaaS Security to detect posture risks in your Asana instance, you must onboard your Asana instance to SaaS Security. Through the onboarding process, SaaS Security connects to the Asana API by using an API token that you generate from the Asana admin console. After connecting to the Asana API, SaaS Security scans your Asana workspace for misconfigured settings and account risks.

The supported Asana account plans for SaaS Security scans are:

• Enterprise+

• Legacy Enterprise

To access your Asana instance, SaaS Security requires the following information, which you specify during the onboarding process.

API Token│A service account token that Asana generates for a service account that you create. The token is an alphanumeric string that SaaS Security uses to authenticate to the Asana API and leverage the service account's permissions.

| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

To onboard your Asana instance, complete the following actions.

### Step 1: Create a Service Account in Asana and Save the Token

An Asana service account is a non-human, programmatic identity that SaaS Security uses to scan your Asana workspace. When you create a service account, Asana generates and displays a service account token that SaaS Security uses to access the Asana API. Asana displays this token only once, so copy and save the token so you can provide it during onboarding.

1. Open a web browser to the Asana website and log in as a Super Admin.

Note: To create an Asana service account, you must use an account assigned to the Super Admin role. Service accounts are an exclusive feature for organizations on Asana's Enterprise or Enterprise+ plans.

2. Navigate to the Admin Console. Locate your profile picture in the upper-right corner of the Asana webpage and select <profile-picture> > Admin console.

3. In the left navigation pane, select Apps > Service Accounts.

4. On the Service Accounts page, click Add service account.

5. Fill in the Add service account dialog:

• Specify a Name for the service account. For example, SaaS Security Service Account.

• Under Permission scopes, select Full permissions.

6. Click Save changes to generate the service account token. Copy the service account token and paste it into a text file.

Important: Do not continue to the next step unless you have copied the service account token. You must provide this token to SaaS Security during the onboarding process.

### Step 2: (Optional) Update the Token Expiration Period

By default, the lifespan for service account tokens in Asana is 10 years. To limit the attack window if the token becomes compromised, set service account tokens to expire after 90 days.

1. From the left navigation pane in the Admin Console, select Apps > Service Accounts.

2. On the App settings page, locate the Token Expiration settings.

3. For When should service account tokens expire? setting, select 90 days.

4. Click Save changes.

### Step 3: Connect SaaS Security to Your Asana Instance

By adding an Asana app in Cortex, you enable SaaS Security to connect to your Asana instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Asana tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, provide the Tenant ID, Client ID, and Client Secret.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,69 +0,0 @@
----
-description: >-
-  Onboard Asana to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Asana
-
-For SaaS Security to detect posture risks in your Asana instance, you must onboard your Asana instance to SaaS Security. Through the onboarding process, SaaS Security connects to the Asana API by using an API token that you generate from the Asana admin console. After connecting to the Asana API, SaaS Security scans your Asana workspace for misconfigured settings and account risks.
-
-The supported Asana account plans for SaaS Security scans are:
-
-* Enterprise+
-* Legacy Enterprise
-
-To access your Asana instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| API Token | A service account token that Asana generates for a service account that you create. The token is an alphanumeric string that SaaS Security uses to authenticate to the Asana API and leverage the service account's permissions. |
-| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-
-To onboard your Asana instance, complete the following actions.
-
-***
-
-### Step 1: Create a Service Account in Asana and Save the Token
-
-An Asana service account is a non-human, programmatic identity that SaaS Security uses to scan your Asana workspace. When you create a service account, Asana generates and displays a service account token that SaaS Security uses to access the Asana API. Asana displays this token only once, so copy and save the token so you can provide it during onboarding.
-
-1. Open a web browser to the [Asana website](https://asana.com) and log in as a Super Admin.
-
-**Note**: To create an Asana service account, you must use an account assigned to the Super Admin role. Service accounts are an exclusive feature for organizations on Asana's Enterprise or Enterprise+ plans.
-
-2. Navigate to the Admin Console. Locate your profile picture in the upper-right corner of the Asana webpage and select \<profile-picture> > Admin console.
-3. In the left navigation pane, select Apps > Service Accounts.
-4. On the Service Accounts page, click Add service account.
-5. Fill in the Add service account dialog:
-
-* Specify a Name for the service account. For example, SaaS Security Service Account.
-* Under Permission scopes, select Full permissions.
-
-6. Click Save changes to generate the service account token. Copy the service account token and paste it into a text file.
-
-**Important**: Do not continue to the next step unless you have copied the service account token. You must provide this token to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: (Optional) Update the Token Expiration Period
-
-By default, the lifespan for service account tokens in Asana is 10 years. To limit the attack window if the token becomes compromised, set service account tokens to expire after 90 days.
-
-1. From the left navigation pane in the Admin Console, select Apps > Service Accounts.
-2. On the App settings page, locate the Token Expiration settings.
-3. For When should service account tokens expire? setting, select 90 days.
-4. Click Save changes.
-
-***
-
-### Step 3: Connect SaaS Security to Your Asana Instance
-
-By adding an Asana app in Cortex, you enable SaaS Security to connect to your Asana instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Asana tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under **Default Capabilities** and click Next.
-6. Under **Connections**, provide the Tenant ID, Client ID, and Client Secret.
-7. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Atlassian deleted +0 −69

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-atlassian

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,69 +0,0 @@

---

description: >-

Onboard Atlassian to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Atlassian

Connect an Atlassian instance to SaaS Security to detect posture and identity risks, and to enable third-party plugin scans for Jira and Confluence.

For SaaS Security to detect posture risks in your Atlassian instance, you must onboard your Atlassian instance to Cortex. Through the onboarding process, SaaS Security connects to an Atlassian API and, through the API, scans the Atlassian Administration settings for your organization. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices. SaaS Security also runs identity scans for account risks.

Note: Some of the Atlassian Administration settings that SaaS Security scans affect Jira and Confluence. These are high-level Atlassian Administration settings for your organization, and will differ depending on whether your organization has the free, Standard, or Premium versions of these products. To have SaaS Security scan settings at the Jira and Confluence level, you must onboard a Jira app and onboard a Confluence app.

If users have extended the capabilities of Jira and Confluence by installing third-party plugins, SaaS Security also detect the third-party plugins and the access that the plugins were granted. This information helps you determine the risks posed by third-party plugins so you can take action as needed. It is not necessary to onboard Jira and Confluence to SaaS Security to enable these third-party plugin scans.

To access your Atlassian instance, SaaS Security requires the following information, which you specify during the onboarding process.

API Token│A token, generated by an Atlassian Org Admin, that enables SaaS Security to authenticate to the administrator account.

| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

API Key│A key, generated by an Atlassian Org Admin, that enables SaaS Security to scan and update organization settings and user accounts. SaaS Security uses this key to identify and manage the third-party plugins that users have connected to Jira or Confluence.

Admin Email│The login email address of the Atlassian Org Admin who created the API token and API key.

To onboard your Atlassian instance, complete the following actions.

### Step 1: Generate and Copy an Administrator API Token

To authenticate to an administrator account using an Atlassian API, SaaS Security requires an administrator API token.

1. Log in to Atlassian using Org Admin credentials.

2. From the Atlassian account profile, navigate to the API tokens page. Select Security > Create and manage API tokens, or go directly to id.atlassian.com/manage-profile/security/api-tokens.

3. Click Create API Token. A dialog prompts you to specify a label for the API token.

4. Specify a label and click Create. Atlassian generates and displays your new API token.

5. Copy the API token and paste it into a text file.\

Important: Do not continue to the next step unless you have copied the API token. You must provide this token to SaaS Security during the onboarding process.

### Step 2: Generate and Copy an API Key for Your Organization

To identify and manage the third-party plugins that users have connected to Jira or Confluence, SaaS Security requires an API key generated from an administrator account. SaaS Security also requires this API key for identity scans.

1. Log in to the Atlassian Admin Portal using Org Admin credentials.

2. If you administer more than one Atlassian organization, select the organization you want SaaS Security to scan for third-party plugins.

3. From the left navigation, select Organization settings > API keys.

4. On the API keys page, click Create API key.

5. On the Before you begin page, select API key without scopes and click Next.\

Note: You must select the API key without the scopes option. SaaS Security does not support scoped API keys.

6. In the Create an API key dialog, specify a name and an expiration date for the key and click Create. Atlassian generates and displays a new API key.

7. Copy the API key and paste it into a text file.\

Important: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.

### Step 3: Connect SaaS Security to Your Atlassian Instance

By adding an Atlassian app in Cortex, you enable SaaS Security to connect to your Atlassian instance for posture and identity scans. Connecting the Atlassian app also enables SaaS Security to scan for third-party plugins connected to Jira and Confluence.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Atlassian tile.

4. On the Capabilities page, Enter a Name for your application.

5. Select Security Posture under Default Capabilities.

6. Click Next.

7. On the Connections page, enter the login email address of the Atlassian administrator who created the API token, and the API key.

8. On the Configurations page, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

9. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,69 +0,0 @@
----
-description: >-
-  Onboard Atlassian to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Atlassian
-
-Connect an Atlassian instance to SaaS Security to detect posture and identity risks, and to enable third-party plugin scans for Jira and Confluence.
-
-For SaaS Security to detect posture risks in your Atlassian instance, you must onboard your Atlassian instance to Cortex. Through the onboarding process, SaaS Security connects to an Atlassian API and, through the API, scans the Atlassian Administration settings for your organization. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices. SaaS Security also runs identity scans for account risks.
-
-Note: Some of the Atlassian Administration settings that SaaS Security scans affect Jira and Confluence. These are high-level Atlassian Administration settings for your organization, and will differ depending on whether your organization has the free, Standard, or Premium versions of these products. To have SaaS Security scan settings at the Jira and Confluence level, you must onboard a Jira app and onboard a Confluence app.
-
-If users have extended the capabilities of Jira and Confluence by installing third-party plugins, SaaS Security also detect the third-party plugins and the access that the plugins were granted. This information helps you determine the risks posed by third-party plugins so you can take action as needed. It is not necessary to onboard Jira and Confluence to SaaS Security to enable these third-party plugin scans.
-
-To access your Atlassian instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| API Token   | A token, generated by an Atlassian Org Admin, that enables SaaS Security to authenticate to the administrator account.                                                                                                                                         |
-| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| API Key     | A key, generated by an Atlassian Org Admin, that enables SaaS Security to scan and update organization settings and user accounts. SaaS Security uses this key to identify and manage the third-party plugins that users have connected to Jira or Confluence. |
-| Admin Email | The login email address of the Atlassian Org Admin who created the API token and API key.                                                                                                                                                                      |
-
-To onboard your Atlassian instance, complete the following actions.
-
-***
-
-### Step 1: Generate and Copy an Administrator API Token
-
-To authenticate to an administrator account using an Atlassian API, SaaS Security requires an administrator API token.
-
-1. Log in to Atlassian using Org Admin credentials.
-2. From the Atlassian account profile, navigate to the API tokens page. Select Security > Create and manage API tokens, or go directly to[ id.atlassian.com/manage-profile/security/api-tokens](https://id.atlassian.com/manage-profile/security/api-tokens).
-3. Click Create API Token. A dialog prompts you to specify a label for the API token.
-4. Specify a label and click Create. Atlassian generates and displays your new API token.
-5. Copy the API token and paste it into a text file.\
-   Important: Do not continue to the next step unless you have copied the API token. You must provide this token to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Generate and Copy an API Key for Your Organization
-
-To identify and manage the third-party plugins that users have connected to Jira or Confluence, SaaS Security requires an API key generated from an administrator account. SaaS Security also requires this API key for identity scans.
-
-1. Log in to the[ Atlassian Admin Portal](https://admin.atlassian.com/) using Org Admin credentials.
-2. If you administer more than one Atlassian organization, select the organization you want SaaS Security to scan for third-party plugins.
-3. From the left navigation, select Organization settings > API keys.
-4. On the API keys page, click Create API key.
-5. On the Before you begin page, select API key without scopes and click Next.\
-   Note: You must select the API key without the scopes option. SaaS Security does not support scoped API keys.
-6. In the Create an API key dialog, specify a name and an expiration date for the key and click Create. Atlassian generates and displays a new API key.
-7. Copy the API key and paste it into a text file.\
-   Important: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 3: Connect SaaS Security to Your Atlassian Instance
-
-By adding an Atlassian app in Cortex, you enable SaaS Security to connect to your Atlassian instance for posture and identity scans. Connecting the Atlassian app also enables SaaS Security to scan for third-party plugins connected to Jira and Confluence.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Atlassian tile.
-4. On the **Capabilities** page, Enter a Name for your application.
-5. Select Security Posture under **Default Capabilities**.
-6. Click **Next**.
-7. On the **Connections** page, enter the login email address of the Atlassian administrator who created the API token, and the API key.
-8. On the **Configurations** page, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-9. Click **Next** to complete the onboarding validation process.

▸ Onboard Automox deleted +0 −70

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-automox

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,70 +0,0 @@

---

description: >-

Onboard Automox to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Automox

For SaaS Security to detect posture risks in your Automox instance, you must onboard your Automox instance to Cortex. Through the onboarding process, SaaS Security connects to an Automox API by using an API key that you generate from the Automox console. After connecting to the Automox API, SaaS Security scans your Automox instance for misconfigured settings and account risks.

The supported Automox account plans for SaaS Security scans are:

• Automate Essentials

• Automate Enterprise

To access your Automox instance, SaaS Security requires the following information, which you specify during the onboarding process.

API Key│A unique, alphanumeric string that you generate from an Automox account. SaaS Security uses the key to authenticate to the Automox API. The API key inherits the permissions of the Automox account.

| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Organization ID│A unique identifier for your organization within the Automox platform.

To onboard your Automox instance, complete the following actions.

### Step 1: Generate and Copy an API Key for Your Organization

1. Identify the Automox account that you will use to create the API key.

Required Permissions: The account that you use to generate the API key must have the following permissions that SaaS Security requires. To adhere to the principle of least privilege, create a custom role with this exact set of permissions and assign it to the account. The API key inherits these permissions.

• Personal API Keys: Manage

• Organization: Read & Manage

• All API Keys: Read & List

• Groups: Read

• Patch Policy Management: Read

• User Management: Read

2. Using the credentials of the account you identified, log in to the Automox console.

3. Locate the settings menu icon (⋮) in the upper-right corner of the console and select Secrets & Keys.

4. On the Secrets & Keys page, scroll to the API Keys section and click Add.

5. Fill out the fields of the Create an API Key dialog and click Create. Automox adds the new key to the list of API keys.

6. From the API key's entry in the list, click the copy icon to copy the key. Paste the key into a text file.

Note: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.

### Step 2: Identify Your Organization ID

1. Click the organization selector icon in the upper-right corner of the console and select Manage Orgs and Users.

2. On the Setup and Configuration page, select the Organizations tab.

3. From the list of organizations, copy your Organization ID and paste it into a text file.

Note: Do not continue to the next step unless you have copied the Organization ID. You must provide this information to SaaS Security during the onboarding process.

### Step 3: Connect SaaS Security to Your Automox Instance

By adding an Automox app in Cortex, you enable SaaS Security to connect to your Automox instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Automox tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, provide the API key and Organization ID.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,70 +0,0 @@
----
-description: >-
-  Onboard Automox to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Automox
-
-For SaaS Security to detect posture risks in your Automox instance, you must onboard your Automox instance to Cortex. Through the onboarding process, SaaS Security connects to an Automox API by using an API key that you generate from the Automox console. After connecting to the Automox API, SaaS Security scans your Automox instance for misconfigured settings and account risks.
-
-The supported Automox account plans for SaaS Security scans are:
-
-* Automate Essentials
-* Automate Enterprise
-
-To access your Automox instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| API Key         | A unique, alphanumeric string that you generate from an Automox account. SaaS Security uses the key to authenticate to the Automox API. The API key inherits the permissions of the Automox account. |
-| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Organization ID | A unique identifier for your organization within the Automox platform.                                                                                                                               |
-
-To onboard your Automox instance, complete the following actions.
-
-***
-
-### Step 1: Generate and Copy an API Key for Your Organization
-
-1. Identify the Automox account that you will use to create the API key.
-
-Required Permissions: The account that you use to generate the API key must have the following permissions that SaaS Security requires. To adhere to the principle of least privilege, create a custom role with this exact set of permissions and assign it to the account. The API key inherits these permissions.
-
-* Personal API Keys: Manage
-* Organization: Read & Manage
-* All API Keys: Read & List
-* Groups: Read
-* Patch Policy Management: Read
-* User Management: Read
-
-2. Using the credentials of the account you identified, log in to the [Automox console](https://console.automox.com).
-3. Locate the settings menu icon (⋮) in the upper-right corner of the console and select Secrets & Keys.
-4. On the Secrets & Keys page, scroll to the API Keys section and click Add.
-5. Fill out the fields of the Create an API Key dialog and click Create. Automox adds the new key to the list of API keys.
-6. From the API key's entry in the list, click the copy icon to copy the key. Paste the key into a text file.
-
-Note: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Identify Your Organization ID
-
-1. Click the organization selector icon in the upper-right corner of the console and select Manage Orgs and Users.
-2. On the Setup and Configuration page, select the Organizations tab.
-3. From the list of organizations, copy your Organization ID and paste it into a text file.
-
-Note: Do not continue to the next step unless you have copied the Organization ID. You must provide this information to SaaS Security during the onboarding process.
-
-***
-
-### Step 3: Connect SaaS Security to Your Automox Instance
-
-By adding an Automox app in Cortex, you enable SaaS Security to connect to your Automox instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Automox tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, provide the API key and Organization ID.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Businessmap deleted +0 −67

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-businessmap

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,67 +0,0 @@

---

description: >-

Onboard Businessmap to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Businessmap

For SaaS Security to detect posture risks in your Businessmap (formerly Kanbanize) instance, you must onboard your Businessmap instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Businessmap API by using an API key that you generate from a Businessmap account. After connecting to the Businessmap API, SaaS Security scans your Businessmap instance for misconfigured settings and account risks.

To access your Businessmap instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item	Description
API Key	A generated character string that identifies a Businessmap administrator to the Businessmap API. SaaS Security requires this API key to authenticate to the API. The key inherits the permissions of the administrator who creates it. Required permissions: The user who generates the API key must have the following Admin privileges: Manage Integrations, Access Audit Logs.
Host name	A unique subdomain for your Businessmap instance, which appears as part of your Businessmap URL.

To onboard your Businessmap instance, complete the following actions.

### Step 1: Identify the Businessmap Account for API Key Generation

Identify the Businessmap account that you will use to generate the API key.

Required permissions: The account that generates the API key must have the following Admin privileges:

• Manage Integrations

• Access Audit Logs

### Step 2: Log In to Businessmap

Open a web browser to the Businessmap login page or your unique company subdomain URL, and log in to the account you identified.

### Step 3: Identify Your Host Name

After you log in to Businessmap, your host name appears as a unique subdomain in the URL. For example, <subdomain>.kanbanize.com.

Note: Make note of your host name before you continue to the next step. You will provide this host name to SaaS Security during the onboarding process.

### Step 4: Generate and Copy an API Key

1. Click your profile icon in the top-right corner of the page and select API. Businessmap opens your My Account settings to the API tab.

2. If an API key was already generated for the account, it is shown on the API tab. If not, click Generate API key.

3. Copy your API key and paste it into a text file.

Note: Do not continue to the next step unless you have copied your API key. You will provide this key to SaaS Security during the onboarding process.

### Step 5: Connect SaaS Security to Your Businessmap Instance

By adding a Businessmap app in Cortex, you enable SaaS Security to connect to your Businessmap instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Businessmap tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, provide the API key and Host ID.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,67 +0,0 @@
----
-description: >-
-  Onboard Businessmap to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Businessmap
-
-For SaaS Security to detect posture risks in your Businessmap (formerly Kanbanize) instance, you must onboard your Businessmap instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Businessmap API by using an API key that you generate from a Businessmap account. After connecting to the Businessmap API, SaaS Security scans your Businessmap instance for misconfigured settings and account risks.
-
-To access your Businessmap instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-<table data-header-hidden><thead><tr><th width="290">Item</th><th>Description</th></tr></thead><tbody><tr><td>API Key</td><td>A generated character string that identifies a Businessmap administrator to the Businessmap API. SaaS Security requires this API key to authenticate to the API. The key inherits the permissions of the administrator who creates it. Required permissions: The user who generates the API key must have the following Admin privileges: Manage Integrations, Access Audit Logs.</td></tr><tr><td>Host name</td><td>A unique subdomain for your Businessmap instance, which appears as part of your Businessmap URL.</td></tr></tbody></table>
-
-To onboard your Businessmap instance, complete the following actions.
-
-***
-
-### Step 1: Identify the Businessmap Account for API Key Generation
-
-Identify the Businessmap account that you will use to generate the API key.
-
-Required permissions: The account that generates the API key must have the following Admin privileges:
-
-* Manage Integrations
-* Access Audit Logs
-
-***
-
-### Step 2: Log In to Businessmap
-
-Open a web browser to the [Businessmap login page](https://businessmap.io/) or your unique company subdomain URL, and log in to the account you identified.
-
-***
-
-### Step 3: Identify Your Host Name
-
-After you log in to Businessmap, your host name appears as a unique subdomain in the URL. For example, \<subdomain>.kanbanize.com.
-
-Note: Make note of your host name before you continue to the next step. You will provide this host name to SaaS Security during the onboarding process.
-
-***
-
-### Step 4: Generate and Copy an API Key
-
-1. Click your profile icon in the top-right corner of the page and select API. Businessmap opens your My Account settings to the API tab.
-2. If an API key was already generated for the account, it is shown on the API tab. If not, click Generate API key.
-3. Copy your API key and paste it into a text file.
-
-Note: Do not continue to the next step unless you have copied your API key. You will provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 5: Connect SaaS Security to Your Businessmap Instance
-
-By adding a Businessmap app in Cortex, you enable SaaS Security to connect to your Businessmap instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Businessmap tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select **Security Posture** under Default Capabilities and click Next.
-6. Under **Connections**, provide the API key and Host ID.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.
-
-<br>

▸ Onboard Celonis deleted +0 −57

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-celonis

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,57 +0,0 @@

---

description: >-

Onboard Celonis to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Celonis

For SaaS Security to detect posture risks in your Celonis instance, you must onboard your Celonis instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Celonis API and, through the API, scans your Celonis instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

SaaS Security gets access to your Celonis instance through an API access key. During the onboarding process, SaaS Security prompts you for the API access key and related information about your Celonis instance.

To onboard your Celonis instance, complete the following actions:

• Collect information for accessing your Celonis instance

• Connect SaaS Security to your Celonis instance

### Step 1: Collect Information for Accessing Your Celonis Instance

To access your Celonis instance, SaaS Security requires the following information, which you specify during the onboarding process.

Team API Key│A generated character string that identifies a Celonis administrator to the Celonis API. SaaS Security requires this API key to authenticate to the API. Required permissions: The API key must be generated by a user with admin access to your Celonis team.

| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Team domain│The URL for your Celonis team.

As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Celonis instance from SaaS Security.

1. Identify your team domain URL.

The URL for your team domain appears in the address bar of your browser and has the format https://<team-domain>.<region>.celonis.cloud. If you are not certain of your team domain URL, you can query Celonis for a list of all of your teams. To query Celonis for your team domain URL, open a web browser to https://celonis.cloud/find-my-team.

Note: Before you continue to the next step, make note of your team domain URL. You will provide this information to SaaS Security during the onboarding process.

2. Generate an API key for your team domain.

1. Log in to your Celonis team domain as an administrator. The API key inherits the access permissions of the administrator account that generates the key. The account must have Admin access to your team domain.

2. Select Profile menu > Edit Profile.

3. On the Edit Profile page, locate the API-Keys section. Enter a New API Key Name and click Create API Key. Celonis generates and displays a new API key.

4. Click Copy To Clipboard and paste the key into a text file.

Note: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.

### Step 2: Connect SaaS Security to Your Celonis Instance

By adding a Celonis app in Cortex, you enable SaaS Security to connect to your Celonis instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Celonis tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, provide the API key and Team Domain.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,57 +0,0 @@
----
-description: >-
-  Onboard Celonis to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Celonis
-
-For SaaS Security to detect posture risks in your Celonis instance, you must onboard your Celonis instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Celonis API and, through the API, scans your Celonis instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-SaaS Security gets access to your Celonis instance through an API access key. During the onboarding process, SaaS Security prompts you for the API access key and related information about your Celonis instance.
-
-To onboard your Celonis instance, complete the following actions:
-
-* Collect information for accessing your Celonis instance
-* Connect SaaS Security to your Celonis instance
-
-***
-
-### Step 1: Collect Information for Accessing Your Celonis Instance
-
-To access your Celonis instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Team API Key | A generated character string that identifies a Celonis administrator to the Celonis API. SaaS Security requires this API key to authenticate to the API. Required permissions: The API key must be generated by a user with admin access to your Celonis team. |
-| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Team domain  | The URL for your Celonis team.                                                                                                                                                                                                                                 |
-
-As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Celonis instance from SaaS Security.
-
-1. Identify your team domain URL.
-
-The URL for your team domain appears in the address bar of your browser and has the format https://\<team-domain>.\<region>.celonis.cloud. If you are not certain of your team domain URL, you can query Celonis for a list of all of your teams. To query Celonis for your team domain URL, open a web browser to [https://celonis.cloud/find-my-team](https://celonis.cloud/find-my-team).
-
-**Note**: Before you continue to the next step, make note of your team domain URL. You will provide this information to SaaS Security during the onboarding process.
-
-2. Generate an API key for your team domain.
-   1. Log in to your Celonis team domain as an administrator. The API key inherits the access permissions of the administrator account that generates the key. The account must have Admin access to your team domain.
-   2. Select Profile menu > Edit Profile.
-   3. On the Edit Profile page, locate the API-Keys section. Enter a New API Key Name and click Create API Key. Celonis generates and displays a new API key.
-   4. Click Copy To Clipboard and paste the key into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Connect SaaS Security to Your Celonis Instance
-
-By adding a Celonis app in Cortex, you enable SaaS Security to connect to your Celonis instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Celonis tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, provide the API key and Team Domain.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Cisco Duo deleted +0 −68

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-cisco-duo

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,68 +0,0 @@

---

description: >-

Onboard Cisco Duo to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Cisco Duo

For SaaS Security to detect posture risks in your Cisco Duo instance, you must onboard your Cisco Duo instance to SaaS Security. Through the onboarding process, SaaS Security connects to Cisco Duo's Admin API. After connecting to the Admin API, SaaS Security scans your Cisco Duo instance for misconfigured settings and account risks. To enable SaaS Security to connect to the Admin API, you create an Admin API application in Cisco Duo and configure it to grant SaaS Security only the permissions it needs to complete its scans.

The supported Cisco Duo editions for SaaS Security scans are:

• Duo Essentials

• Duo Advantage

• Duo Premier

To access your Cisco Duo instance, SaaS Security requires the following information, which you specify during the onboarding process.

API Hostname│A unique URL that serves as a secure entry point for all API requests between SaaS Security and your Cisco Duo instance. It ensures that SaaS Security is communicating directly with your Cisco Duo account.

| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Integration Key│SaaS Security accesses the Admin API through an Admin API application that you create in Cisco Duo. Cisco Duo generates an Integration Key to uniquely identify this application. The Integration Key acts as a username for SaaS Security to identify itself during the connection process.

Secret Key│SaaS Security accesses the Admin API through an Admin API application that you create in Cisco Duo. Cisco Duo generates a Secret Key, which acts as a password that SaaS Security uses to securely authenticate to Cisco Duo.

To onboard your Cisco Duo instance, complete the following actions.

### Step 1: Create the Admin API Application

Creating an Admin API application establishes a secure identity for SaaS Security within your Cisco Duo account. This identity enables Cisco Duo to recognize SaaS Security and authorize its API requests. You control SaaS Security' level of access by selecting specific permissions during the application setup.

1. Identify the Cisco Duo account that you will use to create the Admin API application. Required Permissions: To create an Admin API application, you must use an account assigned to the Owner role.

2. Open a web browser to the Cisco Duo Admin Login page and log in to the Owner account you identified.

3. From the Dashboard's left navigation menu, select Applications > Applications.

4. On the Applications page, select + Add application.

5. On the Application Catalog page, locate the entry for an Admin API application and click + Add.

6. On your application's properties page, complete the following actions:

1. Under Basic Configuration, specify a meaningful Application name, such as SaaS Security Integration. This name appears in the list of applications on the Applications page and in Cisco Duo administrator logs.

2. Under Details, copy the following items and paste them into a text file:

• Integration key

• Secret key

• API hostname

       **Note**: Do not continue to the next step unless you have copied the Integration key, Secret key, and API hostname. You will provide this information to SaaS Security during the onboarding process.

3. Under Permissions, select the following permissions:

1. Grant administrators - Read

2. Grant read the information

3. Grant applications

4. Grant settings

5. Grant read log

6. Grant resource - Read

7. Click Save to save your Admin API application.

### Step 2: Connect SaaS Security to Your Cisco Duo Instance

By adding a Cisco Duo app in Cortex, you enable SaaS Security to connect to your Cisco Duo instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Cisco Duo tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, provide the Integration Key, Secret Key, and API Hostname.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,68 +0,0 @@
----
-description: >-
-  Onboard Cisco Duo to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Cisco Duo
-
-For SaaS Security to detect posture risks in your Cisco Duo instance, you must onboard your Cisco Duo instance to SaaS Security. Through the onboarding process, SaaS Security connects to Cisco Duo's Admin API. After connecting to the Admin API, SaaS Security scans your Cisco Duo instance for misconfigured settings and account risks. To enable SaaS Security to connect to the Admin API, you create an Admin API application in Cisco Duo and configure it to grant SaaS Security only the permissions it needs to complete its scans.
-
-The supported Cisco Duo editions for SaaS Security scans are:
-
-* Duo Essentials
-* Duo Advantage
-* Duo Premier
-
-To access your Cisco Duo instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| API Hostname    | A unique URL that serves as a secure entry point for all API requests between SaaS Security and your Cisco Duo instance. It ensures that SaaS Security is communicating directly with your Cisco Duo account.                                                                                |
-| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Integration Key | SaaS Security accesses the Admin API through an Admin API application that you create in Cisco Duo. Cisco Duo generates an Integration Key to uniquely identify this application. The Integration Key acts as a username for SaaS Security to identify itself during the connection process. |
-| Secret Key      | SaaS Security accesses the Admin API through an Admin API application that you create in Cisco Duo. Cisco Duo generates a Secret Key, which acts as a password that SaaS Security uses to securely authenticate to Cisco Duo.                                                                |
-
-To onboard your Cisco Duo instance, complete the following actions.
-
-***
-
-### Step 1: Create the Admin API Application
-
-Creating an Admin API application establishes a secure identity for SaaS Security within your Cisco Duo account. This identity enables Cisco Duo to recognize SaaS Security and authorize its API requests. You control SaaS Security' level of access by selecting specific permissions during the application setup.
-
-1. Identify the Cisco Duo account that you will use to create the Admin API application. Required Permissions: To create an Admin API application, you must use an account assigned to the Owner role.
-2. Open a web browser to the [Cisco Duo Admin Login](https://admin.duosecurity.com) page and log in to the Owner account you identified.
-3. From the Dashboard's left navigation menu, select Applications > Applications.
-4. On the Applications page, select + Add application.
-5. On the Application Catalog page, locate the entry for an Admin API application and click + Add.
-6. On your application's properties page, complete the following actions:
-   1. Under Basic Configuration, specify a meaningful Application name, such as SaaS Security Integration. This name appears in the list of applications on the Applications page and in Cisco Duo administrator logs.
-   2.  Under Details, copy the following items and paste them into a text file:
-
-       * Integration key
-       * Secret key
-       * API hostname
-
-       **Note**: Do not continue to the next step unless you have copied the Integration key, Secret key, and API hostname. You will provide this information to SaaS Security during the onboarding process.
-   3. Under Permissions, select the following permissions:
-      1. Grant administrators - Read
-      2. Grant read the information
-      3. Grant applications
-      4. Grant settings
-      5. Grant read log
-      6. Grant resource - Read
-      7. Click Save to save your Admin API application.
-
-***
-
-### Step 2: Connect SaaS Security to Your Cisco Duo Instance
-
-By adding a Cisco Duo app in Cortex, you enable SaaS Security to connect to your Cisco Duo instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Cisco Duo tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, provide the Integration Key, Secret Key, and API Hostname.
-7. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Cisco Meraki deleted +0 −57

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-cisco-meraki

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,57 +0,0 @@

---

description: >-

Onboard Cisco Meraki to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Cisco Meraki

For SaaS Security to detect posture risks in your Cisco Meraki instance, you must onboard your Cisco Meraki instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Cisco Meraki API and, through the API, scans your Cisco Meraki instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

SaaS Security gets access to your Cisco Meraki instance through an API access key. During the onboarding process, SaaS Security prompts you for the API access key.

To onboard your Cisco Meraki instance, complete the following actions:

• Generate an API access key for your organization

• Connect SaaS Security to your Cisco Meraki instance

### Step 1: Generate an API Access Key for Your Organization

To access a Cisco Meraki API, SaaS Security requires an API key that an organization administrator generates. This administrator must also enable access to the Cisco Meraki dashboard API. The API key inherits the permissions of the administrator who generates the key.

1. Log in to Cisco Meraki.

Required Permissions: You must log in as an organization administrator with Full permissions.

2. If more than one Cisco Meraki account and organization are associated with your login email address, Cisco Meraki prompts you to select an organization. Navigate to the organization for which you'll be generating the API access key.

3. From the Cisco Meraki dashboard, navigate to your profile. Locate your login email address in the upper-right corner of the dashboard and select <login_name> > My Profile.

4. On your profile page, locate the API access section and click Generate new API key.

Note: Each administrator can have only two keys associated with their account. If you already have two API keys, you will need to Revoke one before you can Generate new API key.

Cisco Meraki generates and displays your new key.

5. Copy your API key and paste it into a text file.

Note: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.

6. Enable access to the Cisco Meraki dashboard API.

1. Select Organization > Settings to open the Organization Settings page.

2. On the Organization Settings page, locate the Dashboard API access section. Select Enable access to the Cisco Meraki Dashboard API and click Save Changes.

### Step 2: Connect SaaS Security to Your Cisco Meraki Instance

By adding a Cisco Meraki app in Cortex, you enable SaaS Security to connect to your Cisco Meraki instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Cisco Meraki tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, provide your API key.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,57 +0,0 @@
----
-description: >-
-  Onboard Cisco Meraki to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Cisco Meraki
-
-For SaaS Security to detect posture risks in your Cisco Meraki instance, you must onboard your Cisco Meraki instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Cisco Meraki API and, through the API, scans your Cisco Meraki instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-SaaS Security gets access to your Cisco Meraki instance through an API access key. During the onboarding process, SaaS Security prompts you for the API access key.
-
-To onboard your Cisco Meraki instance, complete the following actions:
-
-* Generate an API access key for your organization
-* Connect SaaS Security to your Cisco Meraki instance
-
-***
-
-### Step 1: Generate an API Access Key for Your Organization
-
-To access a Cisco Meraki API, SaaS Security requires an API key that an organization administrator generates. This administrator must also enable access to the Cisco Meraki dashboard API. The API key inherits the permissions of the administrator who generates the key.
-
-1. Log in to Cisco Meraki.
-
-Required Permissions: You must log in as an organization administrator with Full permissions.
-
-2. If more than one Cisco Meraki account and organization are associated with your login email address, Cisco Meraki prompts you to select an organization. Navigate to the organization for which you'll be generating the API access key.
-3. From the Cisco Meraki dashboard, navigate to your profile. Locate your login email address in the upper-right corner of the dashboard and select \<login\_name> > My Profile.
-4. On your profile page, locate the API access section and click Generate new API key.
-
-**Note**: Each administrator can have only two keys associated with their account. If you already have two API keys, you will need to Revoke one before you can Generate new API key.
-
-Cisco Meraki generates and displays your new key.
-
-5. Copy your API key and paste it into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.
-
-6. Enable access to the Cisco Meraki dashboard API.
-   1. Select Organization > Settings to open the Organization Settings page.
-   2. On the Organization Settings page, locate the Dashboard API access section. Select Enable access to the Cisco Meraki Dashboard API and click Save Changes.
-
-***
-
-### Step 2: Connect SaaS Security to Your Cisco Meraki Instance
-
-By adding a Cisco Meraki app in Cortex, you enable SaaS Security to connect to your Cisco Meraki instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Cisco Meraki tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, provide your API key.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard ClickUp deleted +0 −55

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-clickup

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,55 +0,0 @@

---

description: >-

Onboard ClickUp to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard ClickUp

For SaaS Security to detect posture risks in your ClickUp instance, you must onboard your ClickUp instance to SaaS Security. Through the onboarding process, SaaS Security logs in to ClickUp using administrator account credentials. SaaS Security uses this account to scan your ClickUp instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

To onboard your ClickUp instance, complete the following actions:

• Collect information for accessing your ClickUp instance

• Connect SaaS Security to your ClickUp instance

### Step 1: Collect Information for Accessing Your ClickUp Instance

To access your ClickUp instance, SaaS Security requires connection information. During the onboarding process, you specify the following required and optional information.

User Email│The login email address of a ClickUp administrator account. Required Permissions: The user must be assigned to the Admin role, or a role with greater permissions.

| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

Password│The password for the ClickUp administrator account.

MFA Secret Key│(Optional) A key that is used to generate one-time passcodes for multi-factor authentication.

As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your ClickUp instance from SaaS Security.

1. Identify the ClickUp account that SaaS Security will use to access your ClickUp instance. Verify that the account is assigned to the Admin role, or a role with greater permissions.

2. (Optional) Generate and copy an MFA secret key.

MFA provides an extra layer of security when accessing the ClickUp administrator account. To enable this extra layer of security, the administrator account must be configured for MFA that uses time-based one-time passcodes. These one-time passcodes are generated from authenticator apps such as Google Authenticator by using an MFA secret key. Like an authenticator app, SaaS Security uses the MFA secret key for passcode generation.

1. Log in to your ClickUp administrator account.

2. Navigate to your My Settings page. Locate your account avatar in the lower-left corner of the page and select <account-avatar> > My Settings.

3. On your My Settings page, locate the Two-factor authentication (2FA) section and turn on the toggle for Authenticator App (TOTP).

4. A pop-up is displayed, instructing you to install an authenticator app on your cellphone. Decide which authenticator app you will use and download it to your cellphone. After you install the authenticator, click Yes, ready to scan, but do not scan the QR code that is displayed.

5. A pop-up window displays your MFA key as a text string and also as a QR code. Copy and paste the MFA key text string into a text file so you can provide it to SaaS Security during onboarding. Then continue configuring your authenticator app by scanning the QR code or by manually entering the MFA key.

Note: MFA is optional. However, if you want SaaS Security to connect to the administrator account by using MFA, do not continue to the next step unless you have copied the MFA Secret Key. You will provide this key to SaaS Security during the onboarding process.

### Step 2: Connect SaaS Security to Your ClickUp Instance

By adding a ClickUp app in Cortex, you enable SaaS Security to connect to your ClickUp instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the ClickUp tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the administrator login credentials and, optionally, the MFA secret key.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,55 +0,0 @@
----
-description: >-
-  Onboard ClickUp to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard ClickUp
-
-For SaaS Security to detect posture risks in your ClickUp instance, you must onboard your ClickUp instance to SaaS Security. Through the onboarding process, SaaS Security logs in to ClickUp using administrator account credentials. SaaS Security uses this account to scan your ClickUp instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-To onboard your ClickUp instance, complete the following actions:
-
-* Collect information for accessing your ClickUp instance
-* Connect SaaS Security to your ClickUp instance
-
-***
-
-### Step 1: Collect Information for Accessing Your ClickUp Instance
-
-To access your ClickUp instance, SaaS Security requires connection information. During the onboarding process, you specify the following required and optional information.
-
-| User Email     | The login email address of a ClickUp administrator account. Required Permissions: The user must be assigned to the Admin role, or a role with greater permissions. |
-| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Password       | The password for the ClickUp administrator account.                                                                                                                |
-| MFA Secret Key | (Optional) A key that is used to generate one-time passcodes for multi-factor authentication.                                                                      |
-
-As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your ClickUp instance from SaaS Security.
-
-1. Identify the ClickUp account that SaaS Security will use to access your ClickUp instance. Verify that the account is assigned to the Admin role, or a role with greater permissions.
-2. (Optional) Generate and copy an MFA secret key.
-
-MFA provides an extra layer of security when accessing the ClickUp administrator account. To enable this extra layer of security, the administrator account must be configured for MFA that uses time-based one-time passcodes. These one-time passcodes are generated from authenticator apps such as Google Authenticator by using an MFA secret key. Like an authenticator app, SaaS Security uses the MFA secret key for passcode generation.
-
-1. Log in to your ClickUp administrator account.
-2. Navigate to your My Settings page. Locate your account avatar in the lower-left corner of the page and select \<account-avatar> > My Settings.
-3. On your My Settings page, locate the Two-factor authentication (2FA) section and turn on the toggle for Authenticator App (TOTP).
-4. A pop-up is displayed, instructing you to install an authenticator app on your cellphone. Decide which authenticator app you will use and download it to your cellphone. After you install the authenticator, click Yes, ready to scan, but do not scan the QR code that is displayed.
-5. A pop-up window displays your MFA key as a text string and also as a QR code. Copy and paste the MFA key text string into a text file so you can provide it to SaaS Security during onboarding. Then continue configuring your authenticator app by scanning the QR code or by manually entering the MFA key.
-
-**Note**: MFA is optional. However, if you want SaaS Security to connect to the administrator account by using MFA, do not continue to the next step unless you have copied the MFA Secret Key. You will provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Connect SaaS Security to Your ClickUp Instance
-
-By adding a ClickUp app in Cortex, you enable SaaS Security to connect to your ClickUp instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the ClickUp tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the administrator login credentials and, optionally, the MFA secret key.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Contentful deleted +0 −50

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-contentful

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,50 +0,0 @@

---

description: >-

Onboard Contentful to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Contentful

For SaaS Security to detect posture risks in your Contentful instance, you must onboard your Contentful instance to SaaS Security. Through the onboarding process, SaaS Security connects to an API to scan your Contentful instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

SaaS Security gets access to Contentful's content management API by using a personal access token that you generate for a Contentful administrator account. During the onboarding process, SaaS Security prompts you for the personal access token.

To onboard your Contentful instance, complete the following actions:

• Create a personal access token in Contentful

• Connect SaaS Security to your Contentful instance

### Step 1: Create a Personal Access Token in Contentful

In Contentful, create a personal access token for an administrator account. The access token enables SaaS Security to carry out actions that require administrator permissions.

1. Open a web browser and go to the Contentful login page at be.contentful.com/login.

2. Log in as an administrator.

3. Locate your profile icon and select <profile-icon> > Account settings.

4. On the Account Settings page, navigate to the CMA Tokens tab and click Create personal access token.

5. In the Create personal access token dialog, specify a name and expiration date for the access token. You can also specify that the token should never expire.

Note: SaaS Security uses the access token to establish the initial connection to your Contentful instance and to perform scans at regular intervals. These scans will fail after the token expires, and you will need to onboard your Contentful instance again.

6. Click Generate. Contentful generates and displays your personal access token.

7. Copy the generated token and paste it into a text file.

Note: Do not continue to the next step unless you have copied the access token. You must provide this token to SaaS Security during the onboarding process.

### Step 2: Connect SaaS Security to Your Contentful Instance

By adding a Contentful app in Cortex, you enable SaaS Security to connect to your Contentful instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Contentful tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter your personal access key.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,50 +0,0 @@
----
-description: >-
-  Onboard Contentful to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Contentful
-
-For SaaS Security to detect posture risks in your Contentful instance, you must onboard your Contentful instance to SaaS Security. Through the onboarding process, SaaS Security connects to an API to scan your Contentful instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-SaaS Security gets access to Contentful's content management API by using a personal access token that you generate for a Contentful administrator account. During the onboarding process, SaaS Security prompts you for the personal access token.
-
-To onboard your Contentful instance, complete the following actions:
-
-* Create a personal access token in Contentful
-* Connect SaaS Security to your Contentful instance
-
-***
-
-### Step 1: Create a Personal Access Token in Contentful
-
-In Contentful, create a personal access token for an administrator account. The access token enables SaaS Security to carry out actions that require administrator permissions.
-
-1. Open a web browser and go to the Contentful login page at [be.contentful.com/login](https://be.contentful.com/login).
-2. Log in as an administrator.
-3. Locate your profile icon and select \<profile-icon> > Account settings.
-4. On the Account Settings page, navigate to the CMA Tokens tab and click Create personal access token.
-5. In the Create personal access token dialog, specify a name and expiration date for the access token. You can also specify that the token should never expire.
-
-**Note**: SaaS Security uses the access token to establish the initial connection to your Contentful instance and to perform scans at regular intervals. These scans will fail after the token expires, and you will need to onboard your Contentful instance again.
-
-6. Click Generate. Contentful generates and displays your personal access token.
-7. Copy the generated token and paste it into a text file.
-
-Note: Do not continue to the next step unless you have copied the access token. You must provide this token to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Connect SaaS Security to Your Contentful Instance
-
-By adding a Contentful app in Cortex, you enable SaaS Security to connect to your Contentful instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Contentful tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter your personal access key.
-7. Under **Configurations**, select a Sync Interval. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Couchbase deleted +0 −58

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-couchbase

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,58 +0,0 @@

---

description: >-

Onboard Couchbase to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Couchbase

For SaaS Security to detect posture risks in your Couchbase instance, you must onboard your Couchbase instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Couchbase API by using an API key that you generate from within Couchbase. After connecting to the Couchbase API, SaaS Security scans your Couchbase instance for misconfigured settings and account risks.

The supported Couchbase account plans for SaaS Security scans are:

• Developer Pro

• Enterprise

To access your Couchbase instance, SaaS Security requires the following information, which you specify during the onboarding process.

API Key│A unique, confidential alphanumeric string that you generate using an Organization Owner account on the Couchbase Capella platform. This credential, which Couchbase calls the API Secret, proves your identity and grants SaaS Security the authority to authenticate and interact with your Couchbase instance. Couchbase displays this sensitive API Secret only once during key generation.

| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

To onboard your Couchbase instance, complete the following actions.

### Step 1: Generate and Copy the API Key for Your Organization

1. Identify the Couchbase account that you will use to create the API key.

Required Permissions: You will need to assign the API key to the Organization Owner role. For this reason, the account that you use to create the key must also be assigned to the Organization Owner role.

2. Open a web browser to the Couchbase login page and log in to the Organization Owner account.

3. From the navigation bar at the top of the Couchbase page, navigate to Settings.

4. From the settings menu in the left-hand navigation, select API Keys.

5. On the Management API Keys page, click + Generate Key.

6. On the Generate Management API Key page, complete the following actions:

1. Specify a Key Name for the key. For effective logging and auditing, give the key a meaningful name. For example, SaaS Security Integration.

2. (Optional) Provide a Description of the API key. For example, API key to enable SaaS Security scans.

3. Under Organization Roles, assign your key to the Organization Owner role.

4. Specify a Key Expiration period. The default expiration period is 180 days. Because this key is assigned to the highly-privileged Organization Owner role, we recommend that you set the period to 90 days or less to enforce regular key rotation.

5. Click Generate Key. Couchbase generates the API key and its associated API secret.

7. Copy the API secret and paste it into a text file.

Note: Although SaaS Security prompts you for an API key during onboarding, the value you enter in the API Key field is the API secret. Because Couchbase displays this API secret only once, do not continue to the next step without copying the API secret.

### Step 2: Connect SaaS Security to Your Couchbase Instance

By adding a Couchbase app in Cortex, you enable SaaS Security to connect to your Couchbase instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Couchbase tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the API secret in the API key field

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,58 +0,0 @@
----
-description: >-
-  Onboard Couchbase to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Couchbase
-
-For SaaS Security to detect posture risks in your Couchbase instance, you must onboard your Couchbase instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Couchbase API by using an API key that you generate from within Couchbase. After connecting to the Couchbase API, SaaS Security scans your Couchbase instance for misconfigured settings and account risks.
-
-The supported Couchbase account plans for SaaS Security scans are:
-
-* Developer Pro
-* Enterprise
-
-To access your Couchbase instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| API Key | A unique, confidential alphanumeric string that you generate using an Organization Owner account on the Couchbase Capella platform. This credential, which Couchbase calls the API Secret, proves your identity and grants SaaS Security the authority to authenticate and interact with your Couchbase instance. Couchbase displays this sensitive API Secret only once during key generation. |
-| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-
-To onboard your Couchbase instance, complete the following actions.
-
-***
-
-### Step 1: Generate and Copy the API Key for Your Organization
-
-1. Identify the Couchbase account that you will use to create the API key.
-
-Required Permissions: You will need to assign the API key to the Organization Owner role. For this reason, the account that you use to create the key must also be assigned to the Organization Owner role.
-
-2. Open a web browser to the [Couchbase login page](https://cloud.couchbase.com/sign-in) and log in to the Organization Owner account.
-3. From the navigation bar at the top of the Couchbase page, navigate to Settings.
-4. From the settings menu in the left-hand navigation, select API Keys.
-5. On the Management API Keys page, click + Generate Key.
-6. On the Generate Management API Key page, complete the following actions:
-   1. Specify a Key Name for the key. For effective logging and auditing, give the key a meaningful name. For example, SaaS Security Integration.
-   2. (Optional) Provide a Description of the API key. For example, API key to enable SaaS Security scans.
-   3. Under Organization Roles, assign your key to the Organization Owner role.
-   4. Specify a Key Expiration period. The default expiration period is 180 days. Because this key is assigned to the highly-privileged Organization Owner role, we recommend that you set the period to 90 days or less to enforce regular key rotation.
-   5. Click Generate Key. Couchbase generates the API key and its associated API secret.
-7. Copy the API secret and paste it into a text file.
-
-**Note**: Although SaaS Security prompts you for an API key during onboarding, the value you enter in the API Key field is the API secret. Because Couchbase displays this API secret only once, do not continue to the next step without copying the API secret.
-
-***
-
-### Step 2: Connect SaaS Security to Your Couchbase Instance
-
-By adding a Couchbase app in Cortex, you enable SaaS Security to connect to your Couchbase instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Couchbase tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the API secret in the API key field
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Coveo deleted +0 −66

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-coveo

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,66 +0,0 @@

---

description: >-

Onboard Coveo to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Coveo

For SaaS Security to detect posture risks in your Coveo instance, you must onboard your Coveo instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Coveo API and, through the API, scans your Coveo instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

To access your Coveo instance, SaaS Security requires the following information, which you specify during the onboarding process.

Admin API Key│A generated character string that identifies a Coveo administrator to the Coveo API. SaaS Security requires this API key to authenticate to the API. Required permissions: The Admin API key must be generated by an administrator of your organization.

| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Organization ID│A unique identifier that Coveo assigned to your organization.

To onboard your Coveo instance, complete the following actions.

### Step 1: Generate and Configure an Admin API Key for Your Organization

1. As an administrator of your organization, log in to the Coveo Administration Console.

2. In the left navigation pane, select API Keys. The API Keys item is located in the Organization section of the menu.

3. On the API Keys page, click Add key. Coveo displays the Add an API key page, which provides steps for defining the API key.

4. Follow the steps on the API key page to define your API key:

1. On the Key purpose page, do not choose any of the predefined templates. Instead, select the Custom option to create a custom combination of privileges. Click Next.

2. On the Identification page, specify a meaningful Name for the API key, such as SaaS Security Integration. You can optionally specify a longer Description. Click Next.

3. On the Privileges page, grant the API key the following privileges. Click Next.

Groups│View all

| ------------ | -------- |

Organization│View

4. On the Configuration page, set the Expiration date to 1 year. Click Next.

5. Do not modify the Access page. Click Next.

6. Review the details of your key on the Review page and click Add API key. Coveo generates and displays your API key.

7. Copy the API key and paste it into a text file.

Note: Do not continue to the next step unless you have copied the API key. You will provide this key to SaaS Security during the onboarding process.

### Step 2: Identify Your Organization ID

1. In the left navigation pane of the Coveo Administration Console, select Settings. The Settings item is located in the Organization section of the menu.

2. On the Settings page, select the Organization tab.

3. View the organization Details, which include your Organization ID.

4. Copy your Organization ID and paste it into a text file.

Note: Do not continue to the next step unless you have copied the Organization ID. You will provide this information to SaaS Security during the onboarding process.

### Step 3: Connect SaaS Security to Your Coveo Instance

By adding a Coveo app in Cortex, you enable SaaS Security to connect to your Coveo instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Coveo tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the Admin API Key and Organization ID

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,66 +0,0 @@
----
-description: >-
-  Onboard Coveo to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Coveo
-
-For SaaS Security to detect posture risks in your Coveo instance, you must onboard your Coveo instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Coveo API and, through the API, scans your Coveo instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-To access your Coveo instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Admin API Key   | A generated character string that identifies a Coveo administrator to the Coveo API. SaaS Security requires this API key to authenticate to the API. Required permissions: The Admin API key must be generated by an administrator of your organization. |
-| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Organization ID | A unique identifier that Coveo assigned to your organization.                                                                                                                                                                                            |
-
-To onboard your Coveo instance, complete the following actions.
-
-***
-
-### Step 1: Generate and Configure an Admin API Key for Your Organization
-
-1. As an administrator of your organization, log in to the [Coveo Administration Console](https://platform.cloud.coveo.com/admin).
-2. In the left navigation pane, select API Keys. The API Keys item is located in the Organization section of the menu.
-3. On the API Keys page, click Add key. Coveo displays the Add an API key page, which provides steps for defining the API key.
-4. Follow the steps on the API key page to define your API key:
-   1. On the Key purpose page, do not choose any of the predefined templates. Instead, select the Custom option to create a custom combination of privileges. Click Next.
-   2. On the Identification page, specify a meaningful Name for the API key, such as SaaS Security Integration. You can optionally specify a longer Description. Click Next.
-   3. On the Privileges page, grant the API key the following privileges. Click Next.
-
-| Groups       | View all |
-| ------------ | -------- |
-| Organization | View     |
-
-4. On the Configuration page, set the Expiration date to 1 year. Click Next.
-5. Do not modify the Access page. Click Next.
-6. Review the details of your key on the Review page and click Add API key. Coveo generates and displays your API key.
-7. Copy the API key and paste it into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the API key. You will provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Identify Your Organization ID
-
-1. In the left navigation pane of the Coveo Administration Console, select Settings. The Settings item is located in the Organization section of the menu.
-2. On the Settings page, select the Organization tab.
-3. View the organization Details, which include your Organization ID.
-4. Copy your Organization ID and paste it into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the Organization ID. You will provide this information to SaaS Security during the onboarding process.
-
-***
-
-### Step 3: Connect SaaS Security to Your Coveo Instance
-
-By adding a Coveo app in Cortex, you enable SaaS Security to connect to your Coveo instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Coveo tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the Admin API Key and Organization ID
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Databricks deleted +0 −157

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-databricks

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,157 +0,0 @@

---

description: >-

Onboard Databricks to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Databricks

This page covers two onboarding methods. Use the method that matches your environment:

• Onboard Using Credentials — for posture scans using an administrator account via Okta or Azure AD

• Onboard Using a Service Principal — for identity scans using a Databricks managed service principal

### Method 1: Onboard Using Credentials (Okta or Azure AD)

For SaaS Security to detect posture risks in your Databricks instance, you must onboard your Databricks instance to SaaS Security. Through the onboarding process, SaaS Security logs in to Databricks using administrator account credentials via Okta SSO or Microsoft Azure AD.

To access your Databricks instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Username│The username or email address of the account that SaaS Security will use to access your Databricks instance. Required Permissions: The user must be a Databricks administrator.

Password│The password for the login account.

If you're logging in through Okta, you must also provide:

Item│Description

| --------------- | ------------------------------------------------------------------------------------------------------------ |

Okta subdomain│The Okta subdomain for your organization, included in the login URL that Okta assigned to your organization.

Okta 2FA secret│A key used to generate one-time passcodes for MFA.

If you're using Azure Active Directory (AD) as your identity provider, you must also provide:

Item│Description

| ---------------- | -------------------------------------------------- |

Azure 2FA secret│A key used to generate one-time passcodes for MFA.

#### Step 1: Collect Credentials

1. Identify the account that SaaS Security will use to access your Databricks instance. The user account must have administrator privileges in Databricks.

2. Get a secret key for MFA. The steps differ depending on your identity provider:

• (For Okta login): Identify your Okta subdomain, then generate and copy an MFA secret key.

• (For Microsoft Azure login): Enable third-party software OATH tokens for the administrator account, then configure the account for MFA and copy the MFA secret key.

#### Step 2: Connect SaaS Security to Your Databricks Instance

By adding a Databricks app in Cortex, you enable SaaS Security to connect to your Databricks instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Databricks tile.

4. Enter a name for your app in the Capabilities field.

5. Select Security Posture under Security Capabilities.

6. Click Next.

7. On the Connections tab, specify how you want SaaS Security to connect: Log in with Okta or Log in with Azure.

8. When prompted, provide the login credentials and the information needed for MFA.

9. Click Next to complete the onboarding validation process.

### Method 2: Onboard Using a Service Principal

For SaaS Security to detect identity risks in your Databricks instance, you must onboard your Databricks instance to SaaS Security using a Databricks managed service principal. After connecting to the Databricks API, SaaS Security runs identity scans of your Databricks instance to detect account risks.

To onboard your Databricks instance, SaaS Security requires the following information.

Item│Description

| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Client ID│SaaS Security accesses a Databricks API through a service principal that you create. Databricks generates the Client ID to uniquely identify this service principal.

Client Secret│SaaS Security accesses a Databricks API through a service principal that you create. Databricks generates the Client Secret, which SaaS Security uses to authenticate to the API.

Account ID│An alphanumeric string that uniquely identifies your Databricks account.

Warehouse ID│The unique identifier of the SQL warehouse that SaaS Security will use to query data from your Databricks instance.

Required Permissions: You must be assigned to both the Account Admin and Workspace Admin roles.

#### Step 1: Identify Your Account ID

1. Open a web browser to the Databricks Account Console login page and log in as an administrator assigned to both the Account Admin and Workspace Admin roles.

2. In the upper-right corner of the console, locate and click your user icon or name. The drop-down menu includes your account ID.

3. Copy your account ID and paste it into a text file.

Note: Do not continue to the next step unless you have copied the account ID. You will provide this information to SaaS Security during the onboarding process.

#### Step 2: Create a Databricks Managed Service Principal

A Databricks managed service principal is a non-human, programmatic identity that SaaS Security uses to scan your Databricks instance. When you create a service principal, Databricks generates and displays the Client ID and Client Secret that SaaS Security uses to access the Databricks API.

1. From the left navigation pane, select User management.

2. On the User Management page, select the Service principals tab and click Add service principal.

3. In the Add Service Principal dialog, specify a meaningful name for the service principal. For example: SaaS Security Service Principal. Click Add service principal to create it.

Databricks displays a configuration page for your new service principal.

4. On the configuration page, select the Roles tab and select the Account admin role.

5. Select the Credentials & Secrets tab and click Generate secret.

6. In the Generate OAuth Secret dialog, specify an expiration period and click Generate.

Databricks displays the Client ID and Client Secret for your service principal.

7. Copy the Client ID and Client Secret and paste them into a text file.

Note: Do not continue to the next step unless you have copied the Client ID and Client Secret. You will provide this information to SaaS Security during the onboarding process.

#### Step 3: Create an SQL Warehouse

Note: If you already have an SQL warehouse, skip this step and provide its warehouse ID to SaaS Security during onboarding. It is not necessary to create a warehouse exclusively for SaaS Security.

The SQL warehouse provides SaaS Security with the compute resources needed to run SQL queries on your Databricks instance.

1. Navigate to a workspace where you will create the SQL warehouse:

• From the left navigation pane, select Workspaces.

• On the Workspaces page, click the link for the workspace.

• On the workspace's page, click the URL link.

Note: If you have multiple workspaces, create the SQL warehouse in any one of them. Because all workspaces are linked to a central Unity Catalog metastore, the warehouse can query data across workspaces.

2. From the left navigation pane, select SQL Warehouses. Databricks opens the Compute page at the SQL Warehouses tab.

3. Click Create SQL Warehouse.

4. In the New SQL Warehouse dialog:

1. Specify a Name for the warehouse. For example, SaaS Security Warehouse.

2. Specify a Cluster size. The minimum requirement is 2X-Small.

3. Set the Auto stop time to 5 minutes.

4. Click Create. Databricks creates the SQL warehouse and displays an Overview of its properties.

5. From the overview page, copy the warehouse ID and paste it into a text file.

    Note: Do not continue to the next step unless you have copied the warehouse ID. You will provide this information to SaaS Security during the onboarding process.

5. Grant your service principal permission to execute queries on the warehouse:

6. From the overview page, select Permissions.

7. Use the search field in the Manage Permissions dialog to select the service principal.

8. Set the service principal's permission to Can use.

9. From the overview page, click Start to start the warehouse.

#### Step 4: Enable Delta Sharing for Your Databricks Workspaces

Repeat the following steps for each of your workspaces:

1. From the left navigation pane, select Workspaces.

2. On the Workspaces page, click the link for the workspace's Metastore.

3. On the Configuration tab for the metastore, select the check box to Allow Delta Sharing with parties outside your organization.

#### Step 5: Connect SaaS Security to Your Databricks Instance

By adding a Databricks app in Cortex, you enable SaaS Security to connect to your Databricks instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Databricks tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the Client ID, Client Secret, Account ID, and Warehouse ID.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,157 +0,0 @@
----
-description: >-
-  Onboard Databricks to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Databricks
-
-This page covers two onboarding methods. Use the method that matches your environment:
-
-* [Onboard Using Credentials](https://docs.google.com/document/d/1EIc1VvKe4SEe6D7jGSeIc_PI5JdhlR6qPPcPrU8Mj70/edit#method-1-onboard-using-credentials-okta-or-azure-ad) — for posture scans using an administrator account via Okta or Azure AD
-* [Onboard Using a Service Principal](https://docs.google.com/document/d/1EIc1VvKe4SEe6D7jGSeIc_PI5JdhlR6qPPcPrU8Mj70/edit#method-2-onboard-using-a-service-principal) — for identity scans using a Databricks managed service principal
-
-***
-
-### Method 1: Onboard Using Credentials (Okta or Azure AD)
-
-For SaaS Security to detect posture risks in your Databricks instance, you must onboard your Databricks instance to SaaS Security. Through the onboarding process, SaaS Security logs in to Databricks using administrator account credentials via Okta SSO or Microsoft Azure AD.
-
-To access your Databricks instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item     | Description                                                                                                                                                                     |
-| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Username | The username or email address of the account that SaaS Security will use to access your Databricks instance. Required Permissions: The user must be a Databricks administrator. |
-| Password | The password for the login account.                                                                                                                                             |
-
-If you're logging in through Okta, you must also provide:
-
-| Item            | Description                                                                                                  |
-| --------------- | ------------------------------------------------------------------------------------------------------------ |
-| Okta subdomain  | The Okta subdomain for your organization, included in the login URL that Okta assigned to your organization. |
-| Okta 2FA secret | A key used to generate one-time passcodes for MFA.                                                           |
-
-If you're using Azure Active Directory (AD) as your identity provider, you must also provide:
-
-| Item             | Description                                        |
-| ---------------- | -------------------------------------------------- |
-| Azure 2FA secret | A key used to generate one-time passcodes for MFA. |
-
-#### Step 1: Collect Credentials
-
-1. Identify the account that SaaS Security will use to access your Databricks instance. The user account must have administrator privileges in Databricks.
-2. Get a secret key for MFA. The steps differ depending on your identity provider:
-
-* (For Okta login): Identify your Okta subdomain, then generate and copy an MFA secret key.
-* (For Microsoft Azure login): Enable third-party software OATH tokens for the administrator account, then configure the account for MFA and copy the MFA secret key.
-
-#### Step 2: Connect SaaS Security to Your Databricks Instance
-
-By adding a Databricks app in Cortex, you enable SaaS Security to connect to your Databricks instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Databricks tile.
-4. Enter a name for your app in the **Capabilities** field.
-5. Select Security Posture under Security Capabilities.
-6. Click Next.
-7. On the **Connections** tab, specify how you want SaaS Security to connect: Log in with Okta or Log in with Azure.
-8. When prompted, provide the login credentials and the information needed for MFA.
-9. Click **Next** to complete the onboarding validation process.
-
-***
-
-### Method 2: Onboard Using a Service Principal
-
-For SaaS Security to detect identity risks in your Databricks instance, you must onboard your Databricks instance to SaaS Security using a Databricks managed service principal. After connecting to the Databricks API, SaaS Security runs identity scans of your Databricks instance to detect account risks.
-
-To onboard your Databricks instance, SaaS Security requires the following information.
-
-| Item          | Description                                                                                                                                                                       |
-| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Client ID     | SaaS Security accesses a Databricks API through a service principal that you create. Databricks generates the Client ID to uniquely identify this service principal.              |
-| Client Secret | SaaS Security accesses a Databricks API through a service principal that you create. Databricks generates the Client Secret, which SaaS Security uses to authenticate to the API. |
-| Account ID    | An alphanumeric string that uniquely identifies your Databricks account.                                                                                                          |
-| Warehouse ID  | The unique identifier of the SQL warehouse that SaaS Security will use to query data from your Databricks instance.                                                               |
-
-Required Permissions: You must be assigned to both the Account Admin and Workspace Admin roles.
-
-#### Step 1: Identify Your Account ID
-
-1. Open a web browser to the [Databricks Account Console login page](https://accounts.cloud.databricks.com/login) and log in as an administrator assigned to both the Account Admin and Workspace Admin roles.
-2. In the upper-right corner of the console, locate and click your user icon or name. The drop-down menu includes your account ID.
-3. Copy your account ID and paste it into a text file.
-
-Note: Do not continue to the next step unless you have copied the account ID. You will provide this information to SaaS Security during the onboarding process.
-
-#### Step 2: Create a Databricks Managed Service Principal
-
-A Databricks managed service principal is a non-human, programmatic identity that SaaS Security uses to scan your Databricks instance. When you create a service principal, Databricks generates and displays the Client ID and Client Secret that SaaS Security uses to access the Databricks API.
-
-1. From the left navigation pane, select User management.
-2. On the User Management page, select the Service principals tab and click Add service principal.
-3. In the Add Service Principal dialog, specify a meaningful name for the service principal. For example: SaaS Security Service Principal. Click Add service principal to create it.
-
-Databricks displays a configuration page for your new service principal.
-
-4. On the configuration page, select the Roles tab and select the Account admin role.
-5. Select the Credentials & Secrets tab and click Generate secret.
-6. In the Generate OAuth Secret dialog, specify an expiration period and click Generate.
-
-Databricks displays the Client ID and Client Secret for your service principal.
-
-7. Copy the Client ID and Client Secret and paste them into a text file.
-
-Note: Do not continue to the next step unless you have copied the Client ID and Client Secret. You will provide this information to SaaS Security during the onboarding process.
-
-#### Step 3: Create an SQL Warehouse
-
-Note: If you already have an SQL warehouse, skip this step and provide its warehouse ID to SaaS Security during onboarding. It is not necessary to create a warehouse exclusively for SaaS Security.
-
-The SQL warehouse provides SaaS Security with the compute resources needed to run SQL queries on your Databricks instance.
-
-1. Navigate to a workspace where you will create the SQL warehouse:
-
-* From the left navigation pane, select Workspaces.
-* On the Workspaces page, click the link for the workspace.
-* On the workspace's page, click the URL link.
-
-Note: If you have multiple workspaces, create the SQL warehouse in any one of them. Because all workspaces are linked to a central Unity Catalog metastore, the warehouse can query data across workspaces.
-
-2. From the left navigation pane, select SQL Warehouses. Databricks opens the Compute page at the SQL Warehouses tab.
-3. Click Create SQL Warehouse.
-4.  In the New SQL Warehouse dialog:
-
-    1. Specify a Name for the warehouse. For example, SaaS Security Warehouse.
-    2. Specify a Cluster size. The minimum requirement is 2X-Small.
-    3. Set the Auto stop time to 5 minutes.
-    4. Click Create. Databricks creates the SQL warehouse and displays an Overview of its properties.
-    5. From the overview page, copy the warehouse ID and paste it into a text file.
-
-    Note: Do not continue to the next step unless you have copied the warehouse ID. You will provide this information to SaaS Security during the onboarding process.
-5. Grant your service principal permission to execute queries on the warehouse:
-6. From the overview page, select Permissions.
-7. Use the search field in the Manage Permissions dialog to select the service principal.
-8. Set the service principal's permission to Can use.
-9. From the overview page, click Start to start the warehouse.
-
-#### Step 4: Enable Delta Sharing for Your Databricks Workspaces
-
-Repeat the following steps for each of your workspaces:
-
-1. From the left navigation pane, select Workspaces.
-2. On the Workspaces page, click the link for the workspace's Metastore.
-3. On the Configuration tab for the metastore, select the check box to Allow Delta Sharing with parties outside your organization.
-
-#### Step 5: Connect SaaS Security to Your Databricks Instance
-
-By adding a Databricks app in Cortex, you enable SaaS Security to connect to your Databricks instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Databricks tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the Client ID, Client Secret, Account ID, and Warehouse ID.
-7. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Datadog deleted +0 −90

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-datadog

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,90 +0,0 @@

---

description: >-

Onboard Datadog to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Datadog

For SaaS Security to detect posture risks in your Datadog instance, you must onboard your Datadog instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Datadog API and, through the API, scans your Datadog instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

To onboard your Datadog instance, complete the following actions:

• Collect information for accessing your Datadog instance

• Connect SaaS Security to your Datadog instance

### Step 1: Collect Information for Accessing Your Datadog Instance

To access your Datadog instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Region│Datadog manages a number of independent sites in separate geographic areas around the world. Because these sites are separate from each other, you must specify which regional Datadog site you are using.

API Key│A generated character string that uniquely identifies your organization to the Datadog API. SaaS Security requires this API key to authenticate to the Datadog API.

Application Key│A generated character string that the Datadog API uses to determine the access permissions of a calling application. The application key is associated with the administrator who generates the key.

As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Datadog instance from SaaS Security.

1. Identify the Datadog administrator account that will generate the API Key and Application Key.

Required Permissions: The administrator must have the Datadog Admin role with the following permissions:

• Org Management

• User App Keys

• API Keys Read

• API Keys Write

2. Identify your Datadog region.

1. Open a web browser and go to the Datadog login page that you use to access your Datadog instance.

2. Make a note of the regional Datadog site that your organization is using. Use the following table to determine your region based on the site URL.

URL│Region

| ------------------------------------------------------ | ------- |

https://app.datadoghq.com│US1

https://us3.datadoghq.com│US3

https://us5.datadoghq.com│US5

https://app.datadoghq.eu│EU1

https://app.ddog-gov.com│US1-FED

Note: Do not continue to the next step unless you have recorded the region information. You must provide this information to SaaS Security during the onboarding process.

c. Log in to the administrator account.

3. Generate an API key for your organization.

1. Click your Datadog account icon in the top-right corner and select Organization Settings.

2. On the Organization Settings page, select API Keys.

3. Click New Key.

4. In the New API Key dialog, enter a name for the key and click Create Key. Datadog generates and displays your new key.

5. Click Copy Key and paste the key into a text file.

    **Note**: Do not continue to the next step unless you have copied the API Key. You must provide this key to SaaS Security during the onboarding process.

4. Generate an Application key to grant SaaS Security access permissions. Note: An application key inherits the permissions of the person who creates it, but you can further limit the application's access to certain authorization scopes. If you scope the application key, SaaS Security will be unable to access some of your Datadog instance's settings — up to 19 settings may be inaccessible, preventing SaaS Security from determining if those settings are misconfigured. To avoid restricting SaaS Security' access, create an unscoped application key.

On the Organization Settings page, select Application Keys.

1. Click New Key.

2. In the New Key dialog, enter a name for the key and click Create Key. Datadog generates and displays your new key.

3. Click Copy Key and paste the key into a text file.

Note: Do not continue to the next step unless you have copied the Application Key. You must provide this key to SaaS Security during the onboarding process.

### Step 2: Connect SaaS Security to Your Datadog Instance

By adding a Datadog app in Cortex, you enable SaaS Security to connect to your Datadog instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Datadog tile.

4. Enter a name for your app in the Capabilities field.

5. Select Security Posture under Security Capabilities and click Next.

6. On the Connections tab, enter the API Key, Application Key, and Region for your Datadog instance.

7. Click Next to complete the onboarding validation process.

\

Show markdown source

@@ -1,90 +0,0 @@
----
-description: >-
-  Onboard Datadog to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Datadog
-
-For SaaS Security to detect posture risks in your Datadog instance, you must onboard your Datadog instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Datadog API and, through the API, scans your Datadog instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-To onboard your Datadog instance, complete the following actions:
-
-* Collect information for accessing your Datadog instance
-* Connect SaaS Security to your Datadog instance
-
-***
-
-### Step 1: Collect Information for Accessing Your Datadog Instance
-
-To access your Datadog instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item            | Description                                                                                                                                                                                                |
-| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Region          | Datadog manages a number of independent sites in separate geographic areas around the world. Because these sites are separate from each other, you must specify which regional Datadog site you are using. |
-| API Key         | A generated character string that uniquely identifies your organization to the Datadog API. SaaS Security requires this API key to authenticate to the Datadog API.                                        |
-| Application Key | A generated character string that the Datadog API uses to determine the access permissions of a calling application. The application key is associated with the administrator who generates the key.       |
-
-As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Datadog instance from SaaS Security.
-
-1. Identify the Datadog administrator account that will generate the API Key and Application Key.
-
-Required Permissions: The administrator must have the Datadog Admin role with the following permissions:
-
-* Org Management
-* User App Keys
-* API Keys Read
-* API Keys Write
-
-2. Identify your Datadog region.
-   1. Open a web browser and go to the Datadog login page that you use to access your Datadog instance.
-   2. Make a note of the regional Datadog site that your organization is using. Use the following table to determine your region based on the site URL.
-
-| URL                                                    | Region  |
-| ------------------------------------------------------ | ------- |
-| [https://app.datadoghq.com](https://app.datadoghq.com) | US1     |
-| [https://us3.datadoghq.com](https://us3.datadoghq.com) | US3     |
-| [https://us5.datadoghq.com](https://us5.datadoghq.com) | US5     |
-| [https://app.datadoghq.eu](https://app.datadoghq.eu)   | EU1     |
-| [https://app.ddog-gov.com](https://app.ddog-gov.com)   | US1-FED |
-
-**Note**: Do not continue to the next step unless you have recorded the region information. You must provide this information to SaaS Security during the onboarding process.
-
-c. Log in to the administrator account.
-
-3.  Generate an API key for your organization.
-
-    1. Click your Datadog account icon in the top-right corner and select Organization Settings.
-    2. On the Organization Settings page, select API Keys.
-    3. Click New Key.
-    4. In the New API Key dialog, enter a name for the key and click Create Key. Datadog generates and displays your new key.
-    5. Click Copy Key and paste the key into a text file.
-
-    **Note**: Do not continue to the next step unless you have copied the API Key. You must provide this key to SaaS Security during the onboarding process.
-4.  Generate an Application key to grant SaaS Security access permissions. **Note**: An application key inherits the permissions of the person who creates it, but you can further limit the application's access to certain authorization scopes. If you scope the application key, SaaS Security will be unable to access some of your Datadog instance's settings — up to 19 settings may be inaccessible, preventing SaaS Security from determining if those settings are misconfigured. To avoid restricting SaaS Security' access, create an unscoped application key.
-
-    On the Organization Settings page, select Application Keys.
-
-    1. Click New Key.
-    2. In the New Key dialog, enter a name for the key and click Create Key. Datadog generates and displays your new key.
-    3. Click Copy Key and paste the key into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the Application Key. You must provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Connect SaaS Security to Your Datadog Instance
-
-By adding a Datadog app in Cortex, you enable SaaS Security to connect to your Datadog instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Datadog tile.
-4. Enter a name for your app in the **Capabilities** field.
-5. Select Security Posture under **Security Capabilities** and click **Next**.
-6. On the **Connections** tab, enter the API Key, Application Key, and Region for your Datadog instance.
-7. Click **Next** to complete the onboarding validation process.
-
-\
-\
-<br>

▸ Onboard Gainsight PX deleted +0 −55

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-gainsight-px

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,55 +0,0 @@

---

description: >-

Onboard Gainsight PX to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Gainsight PX

For SaaS Security to detect posture risks in your Gainsight PX instance, you must onboard your Gainsight PX instance to SaaS Security. Through the onboarding process, SaaS Security logs in to Gainsight PX using administrator account credentials. SaaS Security uses this account to scan your Gainsight PX instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

To onboard your Gainsight PX instance, complete the following actions:

• Collect information for connecting to your Gainsight PX instance

• Connect SaaS Security to your Gainsight PX instance

### Step 1: Collect Information for Connecting to Your Gainsight PX Instance

To access your Gainsight PX instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| --------------- | ---------------------------------------------------------------- |

Email ID│The login email address of a Gainsight PX administrator account.

Password│The password of the Gainsight PX administrator account.

Subscription ID│A unique identifier for your Gainsight PX subscription.

As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Gainsight PX instance from SaaS Security.

1. Identify the Gainsight PX administrator account that SaaS Security will use to access your Gainsight PX instance.

Required Permissions: To enable SaaS Security to scan your Gainsight PX instance, the account must have administrator access.

2. Identify your Gainsight PX subscription ID.

1. Open a web browser to the Gainsight PX login page at app.aptrinsic.com/authentication/login and log in as an administrator.

2. In the left navigation pane, select Administration > SET UP > Company & Timezone.

3. Copy the subscription ID and paste it into a text file.

    **Note**: Do not continue to the next step unless you have copied the subscription ID. You must provide this identifier to SaaS Security during the onboarding process.

### Step 2: Connect SaaS Security to Your Gainsight PX Instance

By adding a Gainsight PX app in Cortex, you enable SaaS Security to connect to your Gainsight PX instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Gainsight PX tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the administrator login credentials and the subscription ID.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,55 +0,0 @@
----
-description: >-
-  Onboard Gainsight PX to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Gainsight PX
-
-For SaaS Security to detect posture risks in your Gainsight PX instance, you must onboard your Gainsight PX instance to SaaS Security. Through the onboarding process, SaaS Security logs in to Gainsight PX using administrator account credentials. SaaS Security uses this account to scan your Gainsight PX instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-To onboard your Gainsight PX instance, complete the following actions:
-
-* Collect information for connecting to your Gainsight PX instance
-* Connect SaaS Security to your Gainsight PX instance
-
-***
-
-### Step 1: Collect Information for Connecting to Your Gainsight PX Instance
-
-To access your Gainsight PX instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item            | Description                                                      |
-| --------------- | ---------------------------------------------------------------- |
-| Email ID        | The login email address of a Gainsight PX administrator account. |
-| Password        | The password of the Gainsight PX administrator account.          |
-| Subscription ID | A unique identifier for your Gainsight PX subscription.          |
-
-As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Gainsight PX instance from SaaS Security.
-
-1. Identify the Gainsight PX administrator account that SaaS Security will use to access your Gainsight PX instance.
-
-Required Permissions: To enable SaaS Security to scan your Gainsight PX instance, the account must have administrator access.
-
-2.  Identify your Gainsight PX subscription ID.
-
-    1. Open a web browser to the Gainsight PX login page at [app.aptrinsic.com/authentication/login](https://app.aptrinsic.com/authentication/login) and log in as an administrator.
-    2. In the left navigation pane, select Administration > SET UP > Company & Timezone.
-    3. Copy the subscription ID and paste it into a text file.
-
-    **Note**: Do not continue to the next step unless you have copied the subscription ID. You must provide this identifier to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Connect SaaS Security to Your Gainsight PX Instance
-
-By adding a Gainsight PX app in Cortex, you enable SaaS Security to connect to your Gainsight PX instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Gainsight PX tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the administrator login credentials and the subscription ID.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Grammarly deleted +0 −51

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-grammarly

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,51 +0,0 @@

---

description: >-

Onboard Grammarly to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Grammarly

For SaaS Security to detect posture risks in your Grammarly instance, you must onboard your Grammarly instance to SaaS Security. Through the onboarding process, SaaS Security logs in to Grammarly using administrator account credentials. SaaS Security uses this account to scan your Grammarly instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

SaaS Security gets access to your Grammarly instance by using Okta SSO credentials that you provide during the onboarding process. For this reason, your organization must be using Okta as an identity provider. The Okta account must be configured for multi-factor authentication (MFA) using one-time passcodes.

To onboard your Grammarly instance, complete the following actions:

• Collect information for accessing your Grammarly instance

• Connect SaaS Security to your Grammarly instance

### Step 1: Collect Information for Accessing Your Grammarly Instance

To access your Grammarly instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| -------------- | ------------------------------------------------------------------------------------------------------------------------------ |

User email│An email address of an Okta user account. Required Permissions: The user must be a Grammarly administrator.

User Password│The password for the Okta user account.

Okta Subdomain│The Okta subdomain for your organization. The subdomain was included in the login URL that Okta assigned to your organization.

MFA Secret Key│A key that is used to generate one-time passcodes for multi-factor authentication.

As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Grammarly instance from SaaS Security.

1. Identify the Okta user account that SaaS Security will use to access your Grammarly instance. The user account must have administrator privileges in Grammarly. SaaS Security needs this administrator access to monitor your Grammarly instance. Note: Remember which account you will use to access your Grammarly instance through Okta SSO authentication from SaaS Security. You will provide the login credentials to SaaS Security during the onboarding process.

2. To access the administrator account using Okta credentials:

1. Identify your Okta subdomain.

2. Generate and copy an MFA secret key.

### Step 2: Connect SaaS Security to Your Grammarly Instance

By adding a Grammarly app in Cortex, you enable SaaS Security to connect to your Grammarly instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Grammarly tile.

4. Under Capabilities, Enter a Name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the user credentials, Okta domain, and MFA secret key for accessing your Grammarly instance.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,51 +0,0 @@
----
-description: >-
-  Onboard Grammarly to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Grammarly
-
-For SaaS Security to detect posture risks in your Grammarly instance, you must onboard your Grammarly instance to SaaS Security. Through the onboarding process, SaaS Security logs in to Grammarly using administrator account credentials. SaaS Security uses this account to scan your Grammarly instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-SaaS Security gets access to your Grammarly instance by using Okta SSO credentials that you provide during the onboarding process. For this reason, your organization must be using Okta as an identity provider. The Okta account must be configured for multi-factor authentication (MFA) using one-time passcodes.
-
-To onboard your Grammarly instance, complete the following actions:
-
-* Collect information for accessing your Grammarly instance
-* Connect SaaS Security to your Grammarly instance
-
-***
-
-### Step 1: Collect Information for Accessing Your Grammarly Instance
-
-To access your Grammarly instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item           | Description                                                                                                                    |
-| -------------- | ------------------------------------------------------------------------------------------------------------------------------ |
-| User email     | An email address of an Okta user account. Required Permissions: The user must be a Grammarly administrator.                    |
-| User Password  | The password for the Okta user account.                                                                                        |
-| Okta Subdomain | The Okta subdomain for your organization. The subdomain was included in the login URL that Okta assigned to your organization. |
-| MFA Secret Key | A key that is used to generate one-time passcodes for multi-factor authentication.                                             |
-
-As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Grammarly instance from SaaS Security.
-
-1. Identify the Okta user account that SaaS Security will use to access your Grammarly instance. The user account must have administrator privileges in Grammarly. SaaS Security needs this administrator access to monitor your Grammarly instance. **Note**: Remember which account you will use to access your Grammarly instance through Okta SSO authentication from SaaS Security. You will provide the login credentials to SaaS Security during the onboarding process.
-2. To access the administrator account using Okta credentials:
-   1. Identify your Okta subdomain.
-   2. Generate and copy an MFA secret key.
-
-***
-
-### Step 2: Connect SaaS Security to Your Grammarly Instance
-
-By adding a Grammarly app in Cortex, you enable SaaS Security to connect to your Grammarly instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Grammarly tile.
-4. Under **Capabilities**, Enter a Name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the user credentials, Okta domain, and MFA secret key for accessing your Grammarly instance.
-7. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
-8. Click **Nex**t to complete the onboarding validation process.

▸ Onboard Harness deleted +0 −51

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-harness

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,51 +0,0 @@

---

description: >-

Onboard Harness to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Harness

For SaaS Security to detect posture risks in your Harness instance, you must onboard your Harness instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Harness API and, through the API, scans your Harness instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

SaaS Security gets access to your Harness instance through an API key. During the onboarding process, SaaS Security prompts you for the API key.

To onboard your Harness instance, complete the following actions:

• Generate an API access key and personal access token

• Connect SaaS Security to your Harness instance

### Step 1: Generate an API Access Key and Personal Access Token

To access a Harness API, SaaS Security requires an API key that contains a personal access token of an administrator assigned to the Account Admin role. The API key inherits the permissions of the administrator who generates the key and token.

1. Open a web browser to the Harness site at www.harness.io and log in as an administrator assigned to the Account Admin role.

Required Permissions: You must log in as an administrator assigned to the Account Admin role. The account must also have permission to View and to Create/Edit authentication settings.

2. To open your profile, click the profile icon in the lower-left corner of the window.

3. On your profile, click + API Key. The New API Key dialog is displayed.

4. Enter a name for your key and click Save. The key appears in the My API Keys area.

5. For the new API key, click + Token. The New Token dialog is displayed.

6. Enter a name and expiration date for the token and click Generate Token.

Harness generates and displays the personal access token. Copy and paste the token into a text file so you can provide it to SaaS Security during onboarding.

Note: Do not continue to the next step unless you have copied the token. When SaaS Security prompts you for an API key during the onboarding process, enter this personal access token.

### Step 2: Connect SaaS Security to Your Harness Instance

By adding a Harness app in Cortex, you enable SaaS Security to connect to your Harness instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Harness tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the API key (personal access token) for accessing your Harness instance.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,51 +0,0 @@
----
-description: >-
-  Onboard Harness to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Harness
-
-For SaaS Security to detect posture risks in your Harness instance, you must onboard your Harness instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Harness API and, through the API, scans your Harness instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-SaaS Security gets access to your Harness instance through an API key. During the onboarding process, SaaS Security prompts you for the API key.
-
-To onboard your Harness instance, complete the following actions:
-
-* Generate an API access key and personal access token
-* Connect SaaS Security to your Harness instance
-
-***
-
-### Step 1: Generate an API Access Key and Personal Access Token
-
-To access a Harness API, SaaS Security requires an API key that contains a personal access token of an administrator assigned to the Account Admin role. The API key inherits the permissions of the administrator who generates the key and token.
-
-1. Open a web browser to the Harness site at [www.harness.io](https://www.harness.io) and log in as an administrator assigned to the Account Admin role.
-
-Required Permissions: You must log in as an administrator assigned to the Account Admin role. The account must also have permission to View and to Create/Edit authentication settings.
-
-2. To open your profile, click the profile icon in the lower-left corner of the window.
-3. On your profile, click + API Key. The New API Key dialog is displayed.
-4. Enter a name for your key and click Save. The key appears in the My API Keys area.
-5. For the new API key, click + Token. The New Token dialog is displayed.
-6. Enter a name and expiration date for the token and click Generate Token.
-
-Harness generates and displays the personal access token. Copy and paste the token into a text file so you can provide it to SaaS Security during onboarding.
-
-**Note**: Do not continue to the next step unless you have copied the token. When SaaS Security prompts you for an API key during the onboarding process, enter this personal access token.
-
-***
-
-### Step 2: Connect SaaS Security to Your Harness Instance
-
-By adding a Harness app in Cortex, you enable SaaS Security to connect to your Harness instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Harness tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the API key (personal access token) for accessing your Harness instance.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Intercom deleted +0 −77

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-intercom

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,77 +0,0 @@

---

description: >-

Onboard Intercom to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Intercom

For SaaS Security to detect posture risks in your Intercom instance, you must onboard your Intercom instance to SaaS Security. Through the onboarding process, SaaS Security connects to an Intercom API by using an access token that you generate from the Intercom Developer Hub. After connecting to the Intercom API, SaaS Security scans your Intercom instance for misconfigured settings and account risks.

To access your Intercom instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Access Token│A unique, alphanumeric string that Intercom generates for an Intercom application that you create. The access token has the permissions that you specify in the Intercom application.

Region│The region where Intercom is hosting your data.

To onboard your Intercom instance, complete the following actions.

### Step 1: Generate and Copy an Access Token

To generate the access token, you need to create an app in Intercom's Developer Hub.

1. Identify the Intercom account that you will use to create the Intercom app.

Required Permissions: To create the Intercom app, the account must be assigned to a role that has the Apps and Integrations Access permissions. This could be a custom Developer role or a role with greater permissions.

2. Open a web browser to the Intercom login page and log in to the account you identified.

3. Navigate to Intercom's Developer Hub:

1. Click the settings icon (gear icon) in the lower-left corner of the window.

2. From the Settings navigation pane, select Integrations > Developer Hub. The Your apps page lists any Intercom apps that you have created.

4. On the Your apps page, click New app.

5. In the New app dialog, complete the following actions:

1. Specify an App Name. Give it a meaningful name, such as SaaS Security Integration Token.

2. Select the Workspace where you want to add the app.

3. Click Create app. Intercom displays a configuration page for the new app.

6. Edit your app to limit its permissions to the minimum that SaaS Security requires. By default, your app has permission to all the data in your workspace.

1. On the configuration page, make sure the Authentication tab is selected.

2. On the Authentication page, click Edit.

3. In the Workspace data area, deselect all the check boxes except for the Read admins check box.

7. Regenerate your access token. Intercom created an access token when you created your app, but that token was created before you modified the app's permissions. You must regenerate the token for the permission updates to take effect.

1. In the left navigation pane, select Test and publish > Your workspaces.

2. On the Your workspaces page, locate the access token and click Regenerate token.

3. A confirmation dialog warns you that regenerating the token will delete the current token. Confirm that you want to Regenerate the token.

4. On the Your workspaces page, copy the access token and paste it into a text file.

    **Note**: Do not continue to the next step unless you have copied the access token. You must provide this token to SaaS Security during the onboarding process.

### Step 2: Identify Your Intercom Region

Use the following table to determine, based on your login URL, the region where Intercom is hosting your data.

URL│Region

| ---------------------------------------------------------- | ------------------- |

https://app.intercom.com│US (United States)

https://app.eu.intercom.com│EU (European Union)

https://app.au.intercom.com│AU (Australia)

### Step 3: Connect SaaS Security to Your Intercom Instance

By adding an Intercom app in Cortex, you enable SaaS Security to connect to your Intercom instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Intercom tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter your access token and region.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,77 +0,0 @@
----
-description: >-
-  Onboard Intercom to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Intercom
-
-For SaaS Security to detect posture risks in your Intercom instance, you must onboard your Intercom instance to SaaS Security. Through the onboarding process, SaaS Security connects to an Intercom API by using an access token that you generate from the Intercom Developer Hub. After connecting to the Intercom API, SaaS Security scans your Intercom instance for misconfigured settings and account risks.
-
-To access your Intercom instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item         | Description                                                                                                                                                                           |
-| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Access Token | A unique, alphanumeric string that Intercom generates for an Intercom application that you create. The access token has the permissions that you specify in the Intercom application. |
-| Region       | The region where Intercom is hosting your data.                                                                                                                                       |
-
-To onboard your Intercom instance, complete the following actions.
-
-***
-
-### Step 1: Generate and Copy an Access Token
-
-To generate the access token, you need to create an app in Intercom's Developer Hub.
-
-1. Identify the Intercom account that you will use to create the Intercom app.
-
-Required Permissions: To create the Intercom app, the account must be assigned to a role that has the Apps and Integrations Access permissions. This could be a custom Developer role or a role with greater permissions.
-
-2. Open a web browser to the [Intercom login page](https://app.intercom.com/admins/sign_in) and log in to the account you identified.
-3. Navigate to Intercom's Developer Hub:
-   1. Click the settings icon (gear icon) in the lower-left corner of the window.
-   2. From the Settings navigation pane, select Integrations > Developer Hub. The Your apps page lists any Intercom apps that you have created.
-4. On the Your apps page, click New app.
-5. In the New app dialog, complete the following actions:
-   1. Specify an App Name. Give it a meaningful name, such as SaaS Security Integration Token.
-   2. Select the Workspace where you want to add the app.
-   3. Click Create app. Intercom displays a configuration page for the new app.
-6. Edit your app to limit its permissions to the minimum that SaaS Security requires. By default, your app has permission to all the data in your workspace.
-   1. On the configuration page, make sure the Authentication tab is selected.
-   2. On the Authentication page, click Edit.
-   3. In the Workspace data area, deselect all the check boxes except for the Read admins check box.
-7.  Regenerate your access token. Intercom created an access token when you created your app, but that token was created before you modified the app's permissions. You must regenerate the token for the permission updates to take effect.
-
-    1. In the left navigation pane, select Test and publish > Your workspaces.
-    2. On the Your workspaces page, locate the access token and click Regenerate token.
-    3. A confirmation dialog warns you that regenerating the token will delete the current token. Confirm that you want to Regenerate the token.
-    4. On the Your workspaces page, copy the access token and paste it into a text file.
-
-    **Note**: Do not continue to the next step unless you have copied the access token. You must provide this token to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Identify Your Intercom Region
-
-Use the following table to determine, based on your login URL, the region where Intercom is hosting your data.
-
-| URL                                                        | Region              |
-| ---------------------------------------------------------- | ------------------- |
-| [https://app.intercom.com](https://app.intercom.com)       | US (United States)  |
-| [https://app.eu.intercom.com](https://app.eu.intercom.com) | EU (European Union) |
-| [https://app.au.intercom.com](https://app.au.intercom.com) | AU (Australia)      |
-
-***
-
-### Step 3: Connect SaaS Security to Your Intercom Instance
-
-By adding an Intercom app in Cortex, you enable SaaS Security to connect to your Intercom instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Intercom tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter your access token and region.
-7. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Jamf Pro deleted +0 −86

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-jamf-pro

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,86 +0,0 @@

---

description: >-

Onboard Jamf Pro to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Jamf Pro

For SaaS Security to detect posture risks in your Jamf Pro instance, you must onboard your Jamf Pro instance to SaaS Security. Through the onboarding process, SaaS Security connects to the Jamf Pro API and, through the API, scans your Jamf Pro instance for misconfigured settings and account risks.

SaaS Security gets access to your Jamf Pro instance through an OAuth 2.0 client that you create. During onboarding, you supply SaaS Security with the application credentials (Client ID and Client Secret) for your OAuth 2.0 client. SaaS Security uses these credentials to access the Jamf Pro API through the OAuth 2.0 client.

To access your Jamf Pro instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Instance URL│The unique URL for your Jamf Pro instance.

Client ID│SaaS Security accesses the Jamf Pro API through an OAuth 2.0 client that you create in Jamf Pro. Jamf Pro generates the Client ID to uniquely identify this OAuth 2.0 client.

Client Secret│SaaS Security accesses the Jamf Pro API through an OAuth 2.0 client that you create in Jamf Pro. Jamf Pro generates the Client Secret, which SaaS Security uses to authenticate to the API.

To onboard your Jamf Pro instance, complete the following actions.

### Step 1: Identify Your Instance URL

Identify your instance URL, which appears in the browser's address bar. Jamf Pro typically creates your instance URL during the initial setup of your Jamf Pro environment. Your full instance URL has the format https://<instance-name>.jamfcloud.com.

Before you continue to the next step, make note of this instance URL. You will provide this URL to SaaS Security during the onboarding process.

### Step 2: Create the OAuth 2.0 Client

An OAuth 2.0 client in Jamf Pro consists of one or more API roles and an API client. An API role is a custom privilege set designed for non-human API access. An API client is the non-human identity that SaaS Security uses to authenticate to your Jamf Pro instance.

Required Permissions: To create an API role and an API client, use an administrator account (an account assigned to the Administrator Privilege Set) with Full Access.

1. Identify the Jamf Pro account that you will use to create the OAuth 2.0 client.

2. Open a web browser to your Jamf Pro login page and log in to the administrator account you identified.

3. Create an API role to assign to your API client.

An API role defines a set of permissions for an API client. Create an API role that allows access to the scopes that SaaS Security needs to complete its scans.

1. From the left navigation pane, select Settings.

2. On the Settings page, locate the System settings and select API roles and clients.

3. On the API roles and clients page, select the API Roles tab and click + New.

4. On the New API Role page, complete the following actions:

5. Specify a Display name for the API role. For example, SaaS Security Role.

6. In the Privileges field, add the following privileges:

Privileges│Scan Type

| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- |

Read Impact Alert Notification Settings, Read App Request Settings, Read Automatically Renew MDM Profile Settings, Read Policies, Read Re-enrollment, Read Computer Check-In, Read User-Initiated Enrollment│Posture

Read API Integrations, Read API Roles, Read Accounts, Read Webhooks│Identity

7. Click Save to save the API role.

8. Create the API client.

The API client is the Jamf Pro non-human identity that SaaS Security uses to authenticate with Jamf Pro. You assign the API role you created to this API client to limit the client's permissions. Creating the API client generates the Client ID and Client Secret necessary for the integration with SaaS Security.

1. On the API roles and clients page, select the API Clients tab and click + New.

2. On the New API Client page, complete the following actions:

3. Specify a Display name for the API client. For example, SaaS Security Integration.

4. In the API Roles field, add the API role that you created.

5. Click Enable API client.

6. Click Save. Jamf Pro saves the API client and displays its configuration details.

7. On the configuration details page for the API client, click Generate client secret. After you confirm that you want to create the secret, Jamf Pro generates and displays the application credentials (Client ID and Client Secret) for your API client.

8. Copy the credentials and paste them into a text file.

Note: Do not continue to the next step unless you have copied both the Client ID and Client Secret. You must provide these credentials to SaaS Security during the onboarding process.

### Step 3: Connect SaaS Security to Your Jamf Pro Instance

By adding a Jamf Pro app in Cortex, you enable SaaS Security to connect to your Jamf Pro instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Jamf Pro tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter your instance URL and the application credentials (Client ID and Client Secret).

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,86 +0,0 @@
----
-description: >-
-  Onboard Jamf Pro to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Jamf Pro
-
-For SaaS Security to detect posture risks in your Jamf Pro instance, you must onboard your Jamf Pro instance to SaaS Security. Through the onboarding process, SaaS Security connects to the Jamf Pro API and, through the API, scans your Jamf Pro instance for misconfigured settings and account risks.
-
-SaaS Security gets access to your Jamf Pro instance through an OAuth 2.0 client that you create. During onboarding, you supply SaaS Security with the application credentials (Client ID and Client Secret) for your OAuth 2.0 client. SaaS Security uses these credentials to access the Jamf Pro API through the OAuth 2.0 client.
-
-To access your Jamf Pro instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item          | Description                                                                                                                                                                                 |
-| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Instance URL  | The unique URL for your Jamf Pro instance.                                                                                                                                                  |
-| Client ID     | SaaS Security accesses the Jamf Pro API through an OAuth 2.0 client that you create in Jamf Pro. Jamf Pro generates the Client ID to uniquely identify this OAuth 2.0 client.               |
-| Client Secret | SaaS Security accesses the Jamf Pro API through an OAuth 2.0 client that you create in Jamf Pro. Jamf Pro generates the Client Secret, which SaaS Security uses to authenticate to the API. |
-
-To onboard your Jamf Pro instance, complete the following actions.
-
-***
-
-### Step 1: Identify Your Instance URL
-
-Identify your instance URL, which appears in the browser's address bar. Jamf Pro typically creates your instance URL during the initial setup of your Jamf Pro environment. Your full instance URL has the format https://\<instance-name>.jamfcloud.com.
-
-Before you continue to the next step, make note of this instance URL. You will provide this URL to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Create the OAuth 2.0 Client
-
-An OAuth 2.0 client in Jamf Pro consists of one or more API roles and an API client. An API role is a custom privilege set designed for non-human API access. An API client is the non-human identity that SaaS Security uses to authenticate to your Jamf Pro instance.
-
-Required Permissions: To create an API role and an API client, use an administrator account (an account assigned to the Administrator Privilege Set) with Full Access.
-
-1. Identify the Jamf Pro account that you will use to create the OAuth 2.0 client.
-2. Open a web browser to your Jamf Pro login page and log in to the administrator account you identified.
-3. Create an API role to assign to your API client.
-
-An API role defines a set of permissions for an API client. Create an API role that allows access to the scopes that SaaS Security needs to complete its scans.
-
-1. From the left navigation pane, select Settings.
-2. On the Settings page, locate the System settings and select API roles and clients.
-3. On the API roles and clients page, select the API Roles tab and click + New.
-4. On the New API Role page, complete the following actions:
-5. Specify a Display name for the API role. For example, SaaS Security Role.
-6. In the Privileges field, add the following privileges:
-
-| Privileges                                                                                                                                                                                                   | Scan Type |
-| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- |
-| Read Impact Alert Notification Settings, Read App Request Settings, Read Automatically Renew MDM Profile Settings, Read Policies, Read Re-enrollment, Read Computer Check-In, Read User-Initiated Enrollment | Posture   |
-| Read API Integrations, Read API Roles, Read Accounts, Read Webhooks                                                                                                                                          | Identity  |
-
-7. Click Save to save the API role.
-8. Create the API client.
-
-The API client is the Jamf Pro non-human identity that SaaS Security uses to authenticate with Jamf Pro. You assign the API role you created to this API client to limit the client's permissions. Creating the API client generates the Client ID and Client Secret necessary for the integration with SaaS Security.
-
-1. On the API roles and clients page, select the API Clients tab and click + New.
-2. On the New API Client page, complete the following actions:
-3. Specify a Display name for the API client. For example, SaaS Security Integration.
-4. In the API Roles field, add the API role that you created.
-5. Click Enable API client.
-6. Click Save. Jamf Pro saves the API client and displays its configuration details.
-7. On the configuration details page for the API client, click Generate client secret. After you confirm that you want to create the secret, Jamf Pro generates and displays the application credentials (Client ID and Client Secret) for your API client.
-8. Copy the credentials and paste them into a text file.
-
-Note: Do not continue to the next step unless you have copied both the Client ID and Client Secret. You must provide these credentials to SaaS Security during the onboarding process.
-
-***
-
-### Step 3: Connect SaaS Security to Your Jamf Pro Instance
-
-By adding a Jamf Pro app in Cortex, you enable SaaS Security to connect to your Jamf Pro instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Jamf Pro tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter your instance URL and the application credentials (Client ID and Client Secret).
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard JumpCloud deleted +0 −58

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-jumpcloud

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,58 +0,0 @@

---

description: >-

Onboard JumpCloud to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard JumpCloud

For SaaS Security to detect posture risks in your JumpCloud instance, you must onboard your JumpCloud instance to SaaS Security. Through the onboarding process, SaaS Security connects to a JumpCloud API by using an API key that you generate from the JumpCloud Admin Portal. After connecting to the JumpCloud API, SaaS Security scans your JumpCloud instance for misconfigured settings and account risks.

To access your JumpCloud instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

API Key│A unique, alphanumeric string that JumpCloud generates for a JumpCloud administrator account. SaaS Security uses the key to authenticate to the JumpCloud API. The API key inherits the permissions of the administrator account.

Organization ID│A unique identifier for your organization within the JumpCloud platform.

To onboard your JumpCloud instance, complete the following actions.

### Step 1: Generate and Copy an API Key for Your Organization

1. Identify the JumpCloud account that you will use to create the API key.

Required Permissions: To create the API key, you must use an account assigned to the Administrator role in JumpCloud. The account must have API access enabled. To enable API access for the Administrator account, contact an administrator assigned to the Administrator with Billing role. Only administrators assigned to the Administrator with Billing role can enable API access for an Administrator account. The API key inherits the permissions of the Administrator account.

2. Using the credentials of the Administrator account, log in to the JumpCloud Admin Portal.

3. Locate your profile icon in the upper-right corner of the page and select <profile-icon> > My API Key.

4. In the API Key dialog, specify a Custom expiration date of 365 days and click Generate New API Key. JumpCloud generates and displays a new API key.

5. Copy the API key and paste it into a text file.

Note: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.

### Step 2: Identify Your Organization ID

1. In the JumpCloud Admin Portal, navigate to your Settings page. In the lower-left corner of the Admin Portal, click Settings.

2. On the Settings page, navigate to the Organization Profile tab.

3. Copy your Organization ID and paste it into a text file.

Note: Do not continue to the next step unless you have copied the Organization ID. You must provide this information to SaaS Security during the onboarding process.

### Step 3: Connect SaaS Security to Your JumpCloud Instance

By adding a JumpCloud app in Cortex, you enable SaaS Security to connect to your JumpCloud instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the JumpCloud tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter your API Key and Organization ID.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,58 +0,0 @@
----
-description: >-
-  Onboard JumpCloud to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard JumpCloud
-
-For SaaS Security to detect posture risks in your JumpCloud instance, you must onboard your JumpCloud instance to SaaS Security. Through the onboarding process, SaaS Security connects to a JumpCloud API by using an API key that you generate from the JumpCloud Admin Portal. After connecting to the JumpCloud API, SaaS Security scans your JumpCloud instance for misconfigured settings and account risks.
-
-To access your JumpCloud instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item            | Description                                                                                                                                                                                                                       |
-| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| API Key         | A unique, alphanumeric string that JumpCloud generates for a JumpCloud administrator account. SaaS Security uses the key to authenticate to the JumpCloud API. The API key inherits the permissions of the administrator account. |
-| Organization ID | A unique identifier for your organization within the JumpCloud platform.                                                                                                                                                          |
-
-To onboard your JumpCloud instance, complete the following actions.
-
-***
-
-### Step 1: Generate and Copy an API Key for Your Organization
-
-1. Identify the JumpCloud account that you will use to create the API key.
-
-Required Permissions: To create the API key, you must use an account assigned to the Administrator role in JumpCloud. The account must have API access enabled. To enable API access for the Administrator account, contact an administrator assigned to the Administrator with Billing role. Only administrators assigned to the Administrator with Billing role can enable API access for an Administrator account. The API key inherits the permissions of the Administrator account.
-
-2. Using the credentials of the Administrator account, log in to the [JumpCloud Admin Portal](https://console.jumpcloud.com/login/admin).
-3. Locate your profile icon in the upper-right corner of the page and select \<profile-icon> > My API Key.
-4. In the API Key dialog, specify a Custom expiration date of 365 days and click Generate New API Key. JumpCloud generates and displays a new API key.
-5. Copy the API key and paste it into a text file.
-
-Note: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Identify Your Organization ID
-
-1. In the JumpCloud Admin Portal, navigate to your Settings page. In the lower-left corner of the Admin Portal, click Settings.
-2. On the Settings page, navigate to the Organization Profile tab.
-3. Copy your Organization ID and paste it into a text file.
-
-Note: Do not continue to the next step unless you have copied the Organization ID. You must provide this information to SaaS Security during the onboarding process.
-
-***
-
-### Step 3: Connect SaaS Security to Your JumpCloud Instance
-
-By adding a JumpCloud app in Cortex, you enable SaaS Security to connect to your JumpCloud instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the JumpCloud tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter your API Key and Organization ID.
-7. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Kustomer deleted +0 −61

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-kustomer

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,61 +0,0 @@

---

description: >-

Onboard Kustomer to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Kustomer

For SaaS Security to detect posture risks in your Kustomer instance, you must onboard your Kustomer instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Kustomer API and, through the API, scans your Kustomer instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

SaaS Security gets access to your Kustomer instance through an API access key. During the onboarding process, SaaS Security prompts you for the API access key and related information for your Kustomer instance.

To onboard your Kustomer instance, complete the following actions:

• Collect information for accessing your Kustomer instance

• Connect SaaS Security to your Kustomer instance

### Step 1: Collect Information for Accessing Your Kustomer Instance

To access your Kustomer instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

API Key│A generated character string that uniquely identifies your organization to the Kustomer API. SaaS Security requires this API key to authenticate to the Kustomer API. Required permissions: The API key must be generated by an administrator and configured with the org.permission role.

Region│The region (US or EU) where your organization deployed Kustomer.

As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Kustomer instance from SaaS Security.

1. Log in to Kustomer as an administrator.

1. Open a web browser and go to the Kustomer login page at www.kustomerapp.com/domain. Enter your organization name and click Continue.

2. Log in using administrator credentials.

3. Generate an API key for your organization.

1. Click the settings icon (gear icon) in the lower-left corner of the window and select SECURITY > API Keys.

2. Click + Add API Key.

3. Fill in the fields of the ADD API KEY dialog:

1. Enter a name for the new API key.

2. In the Roles field, specify org.permission. Required permissions: The key must be configured with the org.permission role.

3. Specify an expiration date for the key.

4. Click Create. Kustomer generates and displays your new key.

5. Copy the API key and paste it into a text file.

    **Note**: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.

4. Identify the region (United States or European Union) where your organization instance was deployed. Because API calls are region-specific, you must provide this information to SaaS Security during the onboarding process.

### Step 2: Connect SaaS Security to Your Kustomer Instance

By adding a Kustomer app in Cortex, you enable SaaS Security to connect to your Kustomer instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Kustomer tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter your API Key and Region.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,61 +0,0 @@
----
-description: >-
-  Onboard Kustomer to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Kustomer
-
-For SaaS Security to detect posture risks in your Kustomer instance, you must onboard your Kustomer instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Kustomer API and, through the API, scans your Kustomer instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-SaaS Security gets access to your Kustomer instance through an API access key. During the onboarding process, SaaS Security prompts you for the API access key and related information for your Kustomer instance.
-
-To onboard your Kustomer instance, complete the following actions:
-
-* Collect information for accessing your Kustomer instance
-* Connect SaaS Security to your Kustomer instance
-
-***
-
-### Step 1: Collect Information for Accessing Your Kustomer Instance
-
-To access your Kustomer instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item    | Description                                                                                                                                                                                                                                                                                |
-| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| API Key | A generated character string that uniquely identifies your organization to the Kustomer API. SaaS Security requires this API key to authenticate to the Kustomer API. Required permissions: The API key must be generated by an administrator and configured with the org.permission role. |
-| Region  | The region (US or EU) where your organization deployed Kustomer.                                                                                                                                                                                                                           |
-
-As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your Kustomer instance from SaaS Security.
-
-1. Log in to Kustomer as an administrator.
-   1. Open a web browser and go to the Kustomer login page at [www.kustomerapp.com/domain](https://www.kustomerapp.com/domain). Enter your organization name and click Continue.
-2. Log in using administrator credentials.
-3.  Generate an API key for your organization.
-
-    1. Click the settings icon (gear icon) in the lower-left corner of the window and select SECURITY > API Keys.
-    2. Click + Add API Key.
-    3. Fill in the fields of the ADD API KEY dialog:
-       1. Enter a name for the new API key.
-       2. In the Roles field, specify org.permission. Required permissions: The key must be configured with the org.permission role.
-       3. Specify an expiration date for the key.
-    4. Click Create. Kustomer generates and displays your new key.
-    5. Copy the API key and paste it into a text file.
-
-    **Note**: Do not continue to the next step unless you have copied the API key. You must provide this key to SaaS Security during the onboarding process.
-4. Identify the region (United States or European Union) where your organization instance was deployed. Because API calls are region-specific, you must provide this information to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Connect SaaS Security to Your Kustomer Instance
-
-By adding a Kustomer app in Cortex, you enable SaaS Security to connect to your Kustomer instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Kustomer tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter your API Key and Region.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Microsoft Entra ID deleted +0 −95

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-microsoft-entra-id

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,95 +0,0 @@

---

description: >-

Onboard Microsoft Entra ID to Cortex XSIAM for SaaS security posture

monitoring and compliance visibility.

---

# Onboard Microsoft Entra ID

For SaaS Security to detect posture risks in your Microsoft Entra ID instance, you must onboard your Microsoft Entra ID instance to SaaS Security. Through the onboarding process, SaaS Security connects to the Microsoft Graph API and, through the API, scans your Microsoft Entra ID instance at regular intervals.

SaaS Security gets access to your Microsoft Entra ID instance through a service principal, which represents a Microsoft Entra application that you create. You configure this application's permissions to enable SaaS Security to access only the API scopes it requires to complete its scans. When you register this application, Microsoft Entra creates the associated service principal that SaaS Security uses to connect to the API.

The supported Microsoft account plans for SaaS Security scans are:

• Microsoft Business Premium

• Microsoft Entra ID P1

To access your Microsoft Entra ID instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Tenant ID│A globally unique identifier (GUID) for your Microsoft Entra tenant.

Client ID│SaaS Security accesses the Microsoft Graph API through a Microsoft Entra service principal that represents an application that you create. Microsoft Entra generates the client ID to uniquely identify the application and its associated service principal.

Client Secret│SaaS Security accesses the Microsoft Graph API through a Microsoft Entra service principal that represents an application that you create. Microsoft Entra generates the client secret, which SaaS Security uses to authenticate to the service principal.

To onboard your Microsoft Entra ID instance, complete the following actions.

### Step 1: Log In to the Microsoft Entra Admin Center

1. Open a web browser to the Microsoft Entra admin center.

2. Log in to the administrator account.

Required Permissions: The administrator must be able to grant access to the API scopes required by SaaS Security.

### Step 2: Create and Register Your Microsoft Entra Application

1. From the left navigation pane in the Microsoft Entra admin center, select App registrations.

2. On the App registrations page, select New application.

3. On the Register an Application page, complete the following actions:

4. Specify a name for the application.

5. Select Accounts in this organizational directory only.

6. Click Register. Microsoft Entra registers your application and displays the details page. Registering the application automatically creates its associated service principal.

### Step 3: Copy the Tenant ID, Client ID, and Client Secret

1. Copy the tenant ID and client ID.

2. From the details page for your application, select Overview.

3. Copy the client ID from the Application (client) ID field and paste it into a text file.

4. Copy the tenant ID from the Directory (tenant) ID field and paste it into a text file. Note: Do not continue to the next step unless you have copied the client ID and tenant ID. You will provide this information to SaaS Security during the onboarding process.

5. Create and copy the client secret.

6. From the details page for your application, select Certificates & secrets > Client secrets.

7. Select New client secret.

8. In the Add a client secret flyout dialog, specify an expiration date for the client secret and click Add.

9. Copy the Value of the new client secret and paste it into a text file.

Note: Do not continue to the next step unless you have copied the client secret. You will need to provide this information to SaaS Security during the onboarding process.

### Step 4: Configure API Permissions for Your Application

Configure your application to enable access only to the Microsoft Graph API scopes that SaaS Security requires.

1. From the details page for your application, select API permissions.

2. On the API permissions page, select Add a permission.

3. In the Request API permissions flyout dialog, select the Microsoft Graph API.

4. Select Application permissions.

5. Select the following API scopes and click Add permissions:

1. AuthenticationContext.Read.All

2. IdentityProvider.Read.All

3. Policy.Read.All

4. RoleManagement.Read.Directory

6. On the API permissions page, verify that all the scopes were added as application permissions.

7. On the API permissions page, select Grant admin consent for your organization.

### Step 5: Connect SaaS Security to Your Microsoft Entra ID Instance

By adding a Microsoft Entra ID app in Cortex, you enable SaaS Security to connect to your Microsoft Entra ID instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Microsoft Entra ID tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, select the Service Principal option, then enter the Client ID, Client Secret, and Tenant ID.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,95 +0,0 @@
----
-description: >-
-  Onboard Microsoft Entra ID to Cortex XSIAM for SaaS security posture
-  monitoring and compliance visibility.
----
-
-# Onboard Microsoft Entra ID
-
-For SaaS Security to detect posture risks in your Microsoft Entra ID instance, you must onboard your Microsoft Entra ID instance to SaaS Security. Through the onboarding process, SaaS Security connects to the Microsoft Graph API and, through the API, scans your Microsoft Entra ID instance at regular intervals.
-
-SaaS Security gets access to your Microsoft Entra ID instance through a service principal, which represents a Microsoft Entra application that you create. You configure this application's permissions to enable SaaS Security to access only the API scopes it requires to complete its scans. When you register this application, Microsoft Entra creates the associated service principal that SaaS Security uses to connect to the API.
-
-The supported Microsoft account plans for SaaS Security scans are:
-
-* Microsoft Business Premium
-* Microsoft Entra ID P1
-
-To access your Microsoft Entra ID instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item          | Description                                                                                                                                                                                                                                                   |
-| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Tenant ID     | A globally unique identifier (GUID) for your Microsoft Entra tenant.                                                                                                                                                                                          |
-| Client ID     | SaaS Security accesses the Microsoft Graph API through a Microsoft Entra service principal that represents an application that you create. Microsoft Entra generates the client ID to uniquely identify the application and its associated service principal. |
-| Client Secret | SaaS Security accesses the Microsoft Graph API through a Microsoft Entra service principal that represents an application that you create. Microsoft Entra generates the client secret, which SaaS Security uses to authenticate to the service principal.    |
-
-To onboard your Microsoft Entra ID instance, complete the following actions.
-
-***
-
-### Step 1: Log In to the Microsoft Entra Admin Center
-
-1. Open a web browser to the [Microsoft Entra admin center](https://entra.microsoft.com).
-2. Log in to the administrator account.
-
-Required Permissions: The administrator must be able to grant access to the API scopes required by SaaS Security.
-
-***
-
-### Step 2: Create and Register Your Microsoft Entra Application
-
-1. From the left navigation pane in the Microsoft Entra admin center, select App registrations.
-2. On the App registrations page, select New application.
-3. On the Register an Application page, complete the following actions:
-4. Specify a name for the application.
-5. Select Accounts in this organizational directory only.
-6. Click Register. Microsoft Entra registers your application and displays the details page. Registering the application automatically creates its associated service principal.
-
-***
-
-### Step 3: Copy the Tenant ID, Client ID, and Client Secret
-
-1. Copy the tenant ID and client ID.
-2. From the details page for your application, select Overview.
-3. Copy the client ID from the Application (client) ID field and paste it into a text file.
-4. Copy the tenant ID from the Directory (tenant) ID field and paste it into a text file. **Note**: Do not continue to the next step unless you have copied the client ID and tenant ID. You will provide this information to SaaS Security during the onboarding process.
-5. Create and copy the client secret.
-6. From the details page for your application, select Certificates & secrets > Client secrets.
-7. Select New client secret.
-8. In the Add a client secret flyout dialog, specify an expiration date for the client secret and click Add.
-9. Copy the Value of the new client secret and paste it into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the client secret. You will need to provide this information to SaaS Security during the onboarding process.
-
-***
-
-### Step 4: Configure API Permissions for Your Application
-
-Configure your application to enable access only to the Microsoft Graph API scopes that SaaS Security requires.
-
-1. From the details page for your application, select API permissions.
-2. On the API permissions page, select Add a permission.
-3. In the Request API permissions flyout dialog, select the Microsoft Graph API.
-4. Select Application permissions.
-5. Select the following API scopes and click Add permissions:
-   1. AuthenticationContext.Read.All
-   2. IdentityProvider.Read.All
-   3. Policy.Read.All
-   4. RoleManagement.Read.Directory
-6. On the API permissions page, verify that all the scopes were added as application permissions.
-7. On the API permissions page, select Grant admin consent for your organization.
-
-***
-
-### Step 5: Connect SaaS Security to Your Microsoft Entra ID Instance
-
-By adding a Microsoft Entra ID app in Cortex, you enable SaaS Security to connect to your Microsoft Entra ID instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Microsoft Entra ID tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, select the Service Principal option, then enter the Client ID, Client Secret, and Tenant ID.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Monday.com deleted +0 −73

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-monday.com

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,73 +0,0 @@

---

description: >-

Onboard Monday.com to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Monday.com

For SaaS Security to detect posture risks in your monday.com instance, you must onboard your monday.com instance to SaaS Security. Through the onboarding process, SaaS Security logs in to monday.com using administrator account credentials. SaaS Security uses this account to scan your monday.com instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

To onboard your monday.com instance, complete the following actions:

• Collect information for connecting to your monday.com instance

• Connect SaaS Security to your monday.com instance

### Step 1: Collect Information for Connecting to Your monday.com Instance

To access your monday.com instance, SaaS Security requires connection information. During the onboarding process, you specify the following required and optional information.

Item│Description

| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Email│The login email address of a monday.com administrator. Required Permissions: You must supply SaaS Security with Admin credentials to your monday.com account.

Password│The password of the monday.com administrator.

Account Domain│The custom domain for your monday.com account. After you log in to monday.com, this domain is part of your monday.com URL in the format <account_domain>.monday.com.

MFA Secret Key│(Optional) A key that is used to generate one-time passcodes for multi-factor authentication.

As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your monday.com instance from SaaS Security.

1. Identify the monday.com administrator whose credentials you will supply to SaaS Security.

Required Permissions: You must supply SaaS Security with Admin credentials to your monday.com account.

2. Identify your monday.com account domain.

After you log in to monday.com, the account domain is a unique subdomain included in the monday.com URL in the format <account_domain>.monday.com. You can also identify your account domain from your profile:

1. Open a web browser and go to the monday.com login page at auth.monday.com/auth/login_monday.

2. Log in to the administrator account that you identified.

3. Navigate to the Administration page. Locate your account avatar and select <account-avatar> > Administration.

4. On the Administration page, select General > Profile. The Account URL (Web Address) field shows your account domain.

5. (Optional) Generate and copy an MFA secret key.

MFA provides an extra layer of security when accessing the monday.com administrator account. To enable this extra layer of security, you must configure the administrator account for MFA that uses time-based one-time passcodes. Like an authenticator app, SaaS Security uses the MFA secret key for passcode generation.

1. Decide which authenticator app you will use and download it to your cellphone. You can use any authenticator app that generates time-based one-time passcodes (TOTP), such as Microsoft Authenticator or Google Authenticator.

2. Open a web browser and go to auth.monday.com/auth/login_monday and log in to the administrator account.

3. Navigate to the Administration page. Locate your account avatar and select <account-avatar> > Administration.

4. On the Administration page, select Security > Login.

5. Locate the Two-Factor Authentication section and click Enable Two-Factor Authentication.

6. When monday.com prompts you to choose your authentication method, select Authentication App and click Continue.

7. A pop-up window displays your MFA secret key as a QR code. Do not scan the QR code. Click Copy code instead to display a text version of the MFA secret key.

8. Copy and paste the text version of the MFA secret key into a text file.

Note: Do not continue to the next step unless you have copied the MFA secret key. You will provide this key to SaaS Security during the onboarding process.

9. Continue configuring your authentication app by scanning the QR code or by manually entering the MFA secret key.

### Step 2: Connect SaaS Security to Your monday.com Instance

By adding a monday.com app in Cortex, you enable SaaS Security to connect to your monday.com instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the monday.com tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the administrator login credentials, your account domain, and, optionally, the MFA secret key.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,73 +0,0 @@
----
-description: >-
-  Onboard Monday.com to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Monday.com
-
-For SaaS Security to detect posture risks in your monday.com instance, you must onboard your monday.com instance to SaaS Security. Through the onboarding process, SaaS Security logs in to monday.com using administrator account credentials. SaaS Security uses this account to scan your monday.com instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-To onboard your monday.com instance, complete the following actions:
-
-* Collect information for connecting to your monday.com instance
-* Connect SaaS Security to your monday.com instance
-
-***
-
-### Step 1: Collect Information for Connecting to Your monday.com Instance
-
-To access your monday.com instance, SaaS Security requires connection information. During the onboarding process, you specify the following required and optional information.
-
-| Item           | Description                                                                                                                                                            |
-| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Email          | The login email address of a monday.com administrator. Required Permissions: You must supply SaaS Security with Admin credentials to your monday.com account.          |
-| Password       | The password of the monday.com administrator.                                                                                                                          |
-| Account Domain | The custom domain for your monday.com account. After you log in to monday.com, this domain is part of your monday.com URL in the format \<account\_domain>.monday.com. |
-| MFA Secret Key | (Optional) A key that is used to generate one-time passcodes for multi-factor authentication.                                                                          |
-
-As you complete the following steps, make note of the values of the items described in the preceding table. You will need to enter these values during onboarding to access your monday.com instance from SaaS Security.
-
-1. Identify the monday.com administrator whose credentials you will supply to SaaS Security.
-
-Required Permissions: You must supply SaaS Security with Admin credentials to your monday.com account.
-
-2. Identify your monday.com account domain.
-
-After you log in to monday.com, the account domain is a unique subdomain included in the monday.com URL in the format \<account\_domain>.monday.com. You can also identify your account domain from your profile:
-
-1. Open a web browser and go to the monday.com login page at [auth.monday.com/auth/login\_monday](https://auth.monday.com/auth/login_monday).
-2. Log in to the administrator account that you identified.
-3. Navigate to the Administration page. Locate your account avatar and select \<account-avatar> > Administration.
-4. On the Administration page, select General > Profile. The Account URL (Web Address) field shows your account domain.
-5. (Optional) Generate and copy an MFA secret key.
-
-MFA provides an extra layer of security when accessing the monday.com administrator account. To enable this extra layer of security, you must configure the administrator account for MFA that uses time-based one-time passcodes. Like an authenticator app, SaaS Security uses the MFA secret key for passcode generation.
-
-1. Decide which authenticator app you will use and download it to your cellphone. You can use any authenticator app that generates time-based one-time passcodes (TOTP), such as Microsoft Authenticator or Google Authenticator.
-2. Open a web browser and go to [auth.monday.com/auth/login\_monday](https://auth.monday.com/auth/login_monday) and log in to the administrator account.
-3. Navigate to the Administration page. Locate your account avatar and select \<account-avatar> > Administration.
-4. On the Administration page, select Security > Login.
-5. Locate the Two-Factor Authentication section and click Enable Two-Factor Authentication.
-6. When monday.com prompts you to choose your authentication method, select Authentication App and click Continue.
-7. A pop-up window displays your MFA secret key as a QR code. Do not scan the QR code. Click Copy code instead to display a text version of the MFA secret key.
-8. Copy and paste the text version of the MFA secret key into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the MFA secret key. You will provide this key to SaaS Security during the onboarding process.
-
-9. Continue configuring your authentication app by scanning the QR code or by manually entering the MFA secret key.
-
-***
-
-### Step 2: Connect SaaS Security to Your monday.com Instance
-
-By adding a monday.com app in Cortex, you enable SaaS Security to connect to your monday.com instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the monday.com tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the administrator login credentials, your account domain, and, optionally, the MFA secret key.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard MongoDB Atlas deleted +0 −63

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-mongodb-atlas

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,63 +0,0 @@

---

description: >-

Onboard MongoDB Atlas to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard MongoDB Atlas

For SaaS Security to detect posture risks in your MongoDB Atlas instance, you must onboard your MongoDB Atlas instance to SaaS Security. Through the onboarding process, SaaS Security connects to the MongoDB Atlas Administration API by using programmatic credentials (Client ID and Client Secret) that you provide. After connecting to the MongoDB Atlas Administration API, SaaS Security scans your MongoDB Atlas organization for misconfigured settings and account risks.

To access your MongoDB Atlas instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Client ID│SaaS Security accesses the MongoDB Atlas Administration API through a MongoDB service account that you create. MongoDB Atlas generates a Client ID to uniquely identify the service account.

Client Secret│SaaS Security accesses the MongoDB Atlas Administration API through a MongoDB service account that you create. MongoDB Atlas generates a client secret for the service account. The API verifies the client secret against the client ID to confirm requests are legitimate.

To onboard your MongoDB Atlas instance, complete the following actions.

### Step 1: Create a Service Account in MongoDB Atlas and Save Its Credentials

A MongoDB Atlas service account is a non-human, programmatic identity that SaaS Security uses to scan your MongoDB organization. When you create a service account, MongoDB Atlas generates and displays the programmatic credentials (Client ID and Client Secret) that SaaS Security uses to access information about your organization.

Note: By following these steps, you onboard only one MongoDB Atlas organization to SaaS Security. If you want SaaS Security to scan multiple organizations, onboard each organization separately.

1. Identify the MongoDB Atlas account that you will use to create the service account.

Required Permissions: A service account is scoped to one organization. To create a service account, you must be assigned to the Organization Owner role for the organization that you want SaaS Security to scan.

2. Open a web browser to the MongoDB Atlas website and log in to the Organization Owner account.

3. If you're a member of multiple organizations, make sure you're in the organization that you want SaaS Security to scan. A selection list in the top-left corner of the MongoDB Atlas page shows your current organization. If necessary, select a different organization from this list.

4. From the left navigation pane, select Access Manager.

5. On the Organization Access Manager page, select Add New > Service Account.

6. On the Create Service account page, specify the following information:

• A Name for the service account. For example, SaaS Security Service Account.

• A Description of the service account. For example, Service account for SaaS Security authentication.

• A Client Secret Expiration date. The recommended expiration period is 90 days.

• The Organization Permissions to grant to the service account. Select Organization Owner permissions. SaaS Security requires this level of access to complete its scans.

7. Click Create. MongoDB Atlas creates the service account and displays the programmatic credentials (Client ID and Client Secret) that SaaS Security uses for authentication.

8. Copy the Client ID and Client Secret and paste them into a text file.

Note: Do not continue to the next step unless you have copied the Client ID and Client Secret. You will provide this information to SaaS Security during the onboarding process.

### Step 2: Connect SaaS Security to Your MongoDB Atlas Instance

By adding a MongoDB Atlas app in Cortex, you enable SaaS Security to connect to your MongoDB Atlas instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the MongoDB Atlas tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the Client ID and Client Secret.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,63 +0,0 @@
----
-description: >-
-  Onboard MongoDB Atlas to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard MongoDB Atlas
-
-For SaaS Security to detect posture risks in your MongoDB Atlas instance, you must onboard your MongoDB Atlas instance to SaaS Security. Through the onboarding process, SaaS Security connects to the MongoDB Atlas Administration API by using programmatic credentials (Client ID and Client Secret) that you provide. After connecting to the MongoDB Atlas Administration API, SaaS Security scans your MongoDB Atlas organization for misconfigured settings and account risks.
-
-To access your MongoDB Atlas instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item          | Description                                                                                                                                                                                                                                                                  |
-| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Client ID     | SaaS Security accesses the MongoDB Atlas Administration API through a MongoDB service account that you create. MongoDB Atlas generates a Client ID to uniquely identify the service account.                                                                                 |
-| Client Secret | SaaS Security accesses the MongoDB Atlas Administration API through a MongoDB service account that you create. MongoDB Atlas generates a client secret for the service account. The API verifies the client secret against the client ID to confirm requests are legitimate. |
-
-To onboard your MongoDB Atlas instance, complete the following actions.
-
-***
-
-### Step 1: Create a Service Account in MongoDB Atlas and Save Its Credentials
-
-A MongoDB Atlas service account is a non-human, programmatic identity that SaaS Security uses to scan your MongoDB organization. When you create a service account, MongoDB Atlas generates and displays the programmatic credentials (Client ID and Client Secret) that SaaS Security uses to access information about your organization.
-
-Note: By following these steps, you onboard only one MongoDB Atlas organization to SaaS Security. If you want SaaS Security to scan multiple organizations, onboard each organization separately.
-
-1. Identify the MongoDB Atlas account that you will use to create the service account.
-
-Required Permissions: A service account is scoped to one organization. To create a service account, you must be assigned to the Organization Owner role for the organization that you want SaaS Security to scan.
-
-2. Open a web browser to [the MongoDB Atlas website](https://cloud.mongodb.com/) and log in to the Organization Owner account.
-3. If you're a member of multiple organizations, make sure you're in the organization that you want SaaS Security to scan. A selection list in the top-left corner of the MongoDB Atlas page shows your current organization. If necessary, select a different organization from this list.
-4. From the left navigation pane, select Access Manager.
-5. On the Organization Access Manager page, select Add New > Service Account.
-6. On the Create Service account page, specify the following information:
-
-* A Name for the service account. For example, SaaS Security Service Account.
-* A Description of the service account. For example, Service account for SaaS Security authentication.
-* A Client Secret Expiration date. The recommended expiration period is 90 days.
-* The Organization Permissions to grant to the service account. Select Organization Owner permissions. SaaS Security requires this level of access to complete its scans.
-
-7. Click Create. MongoDB Atlas creates the service account and displays the programmatic credentials (Client ID and Client Secret) that SaaS Security uses for authentication.
-8. Copy the Client ID and Client Secret and paste them into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the Client ID and Client Secret. You will provide this information to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Connect SaaS Security to Your MongoDB Atlas Instance
-
-By adding a MongoDB Atlas app in Cortex, you enable SaaS Security to connect to your MongoDB Atlas instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the MongoDB Atlas tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the Client ID and Client Secret.
-7. Under **Configurations**, select a **Sync Interval.** Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.
-
-<br>

▸ Onboard MuleSoft deleted +0 −93

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-mulesoft

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,93 +0,0 @@

---

description: >-

Onboard MuleSoft to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard MuleSoft

For SaaS Security to detect posture risks in your MuleSoft instance, you must onboard your MuleSoft instance to SaaS Security. Through the onboarding process, SaaS Security connects to an Anypoint Platform API and, through the API, scans your MuleSoft instance for misconfigured settings and account risks.

SaaS Security gets access to your MuleSoft instance through an OAuth 2.0 application that you create. In the Anypoint Platform, an OAuth 2.0 application is called a Connected App. During onboarding, you supply SaaS Security with the application credentials (Client ID and Client Secret) for your Connected App. SaaS Security uses these credentials to access the Anypoint Platform API.

SaaS Security scans are supported for all MuleSoft paid plans.

To access your MuleSoft instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

Hosted Region│MuleSoft operates multiple independent regional sites worldwide. Because these regional environments are entirely separate from one another, you must provide SaaS Security with the region where MuleSoft hosts your data. You can determine your region from the MuleSoft URL displayed in your browser's address bar.

Client ID│SaaS Security accesses an Anypoint Platform API through a Connected App that you create in the Anypoint Platform. The Anypoint Platform generates the Client ID to uniquely identify this Connected App.

Client Secret│SaaS Security accesses an Anypoint Platform API through a Connected App that you create in the Anypoint Platform. The Anypoint Platform generates the Client Secret, which SaaS Security uses to authenticate to the API through the Connected App.

To onboard your MuleSoft instance, complete the following actions.

### Step 1: Identify the Anypoint Platform Account

Identify the Anypoint Platform account that you will use to create your Connected App.

Required Permissions: To create the Connected App, you must use an Anypoint Platform account assigned to the Organization Administrator role.

### Step 2: Log In to the Anypoint Platform

Open a web browser to the MuleSoft Anypoint Platform login page and log in to the Organization Administrator account you identified.

### Step 3: Identify Your Hosted Region

Use the following table to determine your region based on the MuleSoft URL displayed in your browser's address bar. You will provide this region information to SaaS Security during onboarding.

URL│Region

| ------------------------- | ------------------------------- |

anypoint.mulesoft.com│US

eu1.anypoint.mulesoft.com│Europe

ca1.anypoint.mulesoft.com│Canada

jp1.anypoint.mulesoft.com│Japan

gov.anypoint.mulesoft.com│Gov (MuleSoft Government Cloud)

Note: MuleSoft Government Cloud is a dedicated, high-security instance of Anypoint Platform tailored for U.S. public sector organizations, including federal, state, and local agencies and their authorized partners.

### Step 4: Create Your Connected App

SaaS Security uses this Connected App to authenticate to an Anypoint Platform API to run scans. You configure the Connected App to allow access to only the scopes that SaaS Security requires.

1. From the Anypoint Platform home screen, navigate to the Access Management page. In some interface versions, a link to Access Management is on the home screen. If you do not see a link on the home screen, locate the Access Management link under the main navigation menu in the top-left corner of the Anypoint Platform page.

2. From the left navigation pane of the Access Management page, select Connected Apps.

3. On the Connected Apps page, click Create app.

4. On the Create App page, complete the following actions:

1. Specify a Name for your Connected App. For example, SaaS Security Integration.

2. For the Type of application, select App acts on its own behalf (client credentials).

3. Click Add Scopes and add the following scopes:

1. View Policies

2. Access Controls Viewer

3. View Connected Applications

4. View Environment

5. View Organization

6. View Users in a particular organization

5. Click Save. The Anypoint Platform creates the Connected App and displays it in the list of Connected Apps.

6. From the list on the Connected Apps page, click the name of your Connected App. The Anypoint Platform displays the Update App page, which shows the Connected App credentials (Client ID and Client Secret) that SaaS Security uses to authenticate to an Anypoint Platform API.

7. Copy the Client ID and Client Secret and paste them into a text file.

Note: Do not continue to the next step unless you have copied the Client ID and Client Secret. You must provide this information to SaaS Security during the onboarding process.

### Step 5: Connect SaaS Security to Your MuleSoft Instance

By adding a MuleSoft app in Cortex, you enable SaaS Security to connect to your MuleSoft instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the MuleSoft tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter the Client ID, Client Secret, and Hosted Region for your Connected App.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,93 +0,0 @@
----
-description: >-
-  Onboard MuleSoft to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard MuleSoft
-
-For SaaS Security to detect posture risks in your MuleSoft instance, you must onboard your MuleSoft instance to SaaS Security. Through the onboarding process, SaaS Security connects to an Anypoint Platform API and, through the API, scans your MuleSoft instance for misconfigured settings and account risks.
-
-SaaS Security gets access to your MuleSoft instance through an OAuth 2.0 application that you create. In the Anypoint Platform, an OAuth 2.0 application is called a Connected App. During onboarding, you supply SaaS Security with the application credentials (Client ID and Client Secret) for your Connected App. SaaS Security uses these credentials to access the Anypoint Platform API.
-
-SaaS Security scans are supported for all MuleSoft paid plans.
-
-To access your MuleSoft instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item          | Description                                                                                                                                                                                                                                                                                                              |
-| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Hosted Region | MuleSoft operates multiple independent regional sites worldwide. Because these regional environments are entirely separate from one another, you must provide SaaS Security with the region where MuleSoft hosts your data. You can determine your region from the MuleSoft URL displayed in your browser's address bar. |
-| Client ID     | SaaS Security accesses an Anypoint Platform API through a Connected App that you create in the Anypoint Platform. The Anypoint Platform generates the Client ID to uniquely identify this Connected App.                                                                                                                 |
-| Client Secret | SaaS Security accesses an Anypoint Platform API through a Connected App that you create in the Anypoint Platform. The Anypoint Platform generates the Client Secret, which SaaS Security uses to authenticate to the API through the Connected App.                                                                      |
-
-To onboard your MuleSoft instance, complete the following actions.
-
-***
-
-### Step 1: Identify the Anypoint Platform Account
-
-Identify the Anypoint Platform account that you will use to create your Connected App.
-
-Required Permissions: To create the Connected App, you must use an Anypoint Platform account assigned to the Organization Administrator role.
-
-***
-
-### Step 2: Log In to the Anypoint Platform
-
-Open a web browser to the [MuleSoft Anypoint Platform login page](https://anypoint.mulesoft.com/login/) and log in to the Organization Administrator account you identified.
-
-***
-
-### Step 3: Identify Your Hosted Region
-
-Use the following table to determine your region based on the MuleSoft URL displayed in your browser's address bar. You will provide this region information to SaaS Security during onboarding.
-
-| URL                       | Region                          |
-| ------------------------- | ------------------------------- |
-| anypoint.mulesoft.com     | US                              |
-| eu1.anypoint.mulesoft.com | Europe                          |
-| ca1.anypoint.mulesoft.com | Canada                          |
-| jp1.anypoint.mulesoft.com | Japan                           |
-| gov.anypoint.mulesoft.com | Gov (MuleSoft Government Cloud) |
-
-**Note**: MuleSoft Government Cloud is a dedicated, high-security instance of Anypoint Platform tailored for U.S. public sector organizations, including federal, state, and local agencies and their authorized partners.
-
-***
-
-### Step 4: Create Your Connected App
-
-SaaS Security uses this Connected App to authenticate to an Anypoint Platform API to run scans. You configure the Connected App to allow access to only the scopes that SaaS Security requires.
-
-1. From the Anypoint Platform home screen, navigate to the Access Management page. In some interface versions, a link to Access Management is on the home screen. If you do not see a link on the home screen, locate the Access Management link under the main navigation menu in the top-left corner of the Anypoint Platform page.
-2. From the left navigation pane of the Access Management page, select Connected Apps.
-3. On the Connected Apps page, click Create app.
-4. On the Create App page, complete the following actions:
-   1. Specify a Name for your Connected App. For example, SaaS Security Integration.
-   2. For the Type of application, select App acts on its own behalf (client credentials).
-   3. Click Add Scopes and add the following scopes:
-      1. View Policies
-      2. Access Controls Viewer
-      3. View Connected Applications
-      4. View Environment
-      5. View Organization
-      6. View Users in a particular organization
-5. Click Save. The Anypoint Platform creates the Connected App and displays it in the list of Connected Apps.
-6. From the list on the Connected Apps page, click the name of your Connected App. The Anypoint Platform displays the Update App page, which shows the Connected App credentials (Client ID and Client Secret) that SaaS Security uses to authenticate to an Anypoint Platform API.
-7. Copy the Client ID and Client Secret and paste them into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the Client ID and Client Secret. You must provide this information to SaaS Security during the onboarding process.
-
-***
-
-### Step 5: Connect SaaS Security to Your MuleSoft Instance
-
-By adding a MuleSoft app in Cortex, you enable SaaS Security to connect to your MuleSoft instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the MuleSoft tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter the Client ID, Client Secret, and Hosted Region for your Connected App.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Mural deleted +0 −66

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-mural

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,66 +0,0 @@

---

description: >-

Onboard Mural to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Mural

For SaaS Security to detect posture risks in your Mural instance, you must onboard your Mural instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Mural API by using an Enterprise API key. You generate this key from the Company Dashboard in Mural. After connecting to the Mural API, SaaS Security scans your Mural instance for misconfigured settings and account risks.

The supported Mural account plan for SaaS Security scans is the Enterprise plan. This plan is required for you to create an Enterprise API key.

To onboard your Mural instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

API Key│A generated character string that gives SaaS Security access to Mural's Enterprise API. You configure this key to limit SaaS Security' access to only the scopes it requires. Required permissions: You must be a Company Admin to create the Enterprise API key.

To onboard your Mural instance, complete the following actions.

### Step 1: Identify the Mural Account

Identify the Mural account that you will use to generate the Enterprise API key.

Required permissions: The account that generates the API key must be assigned to the Company Admin role in Mural.

### Step 2: Log In to Mural

Open a web browser to the Mural login page and log in to the account you identified.

### Step 3: Generate and Copy the Enterprise API Key

1. Navigate to the Company Dashboard in Mural. Locate your avatar in the upper-right corner of the Mural page and select <your-avatar> > Manage company.

2. From the Company Dashboard's left-hand navigation pane, select API keys. The API keys item appears under the Development section.

3. On the API Keys page, click Create API Key. The Create API key dialog prompts you to select the API scopes that the key will authorize SaaS Security to access.

4. In the Create API key dialog, select the following scopes, which SaaS Security requires:

• Member information

• User activity logs

• Reports

5. Click Create API key. Mural generates and displays the Enterprise API key.

6. Copy the API key and paste it into a text file.

Note: Do not continue to the next step unless you have copied the API key. This is the only time that Mural displays the API key, and you must provide this key to SaaS Security during the onboarding process.

### Step 4: Connect SaaS Security to Your Mural Instance

By adding a Mural app in Cortex, you enable SaaS Security to connect to your Mural instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Mural tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter your API key.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,66 +0,0 @@
----
-description: >-
-  Onboard Mural to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Mural
-
-For SaaS Security to detect posture risks in your Mural instance, you must onboard your Mural instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Mural API by using an Enterprise API key. You generate this key from the Company Dashboard in Mural. After connecting to the Mural API, SaaS Security scans your Mural instance for misconfigured settings and account risks.
-
-The supported Mural account plan for SaaS Security scans is the Enterprise plan. This plan is required for you to create an Enterprise API key.
-
-To onboard your Mural instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item    | Description                                                                                                                                                                                                                                                       |
-| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| API Key | A generated character string that gives SaaS Security access to Mural's Enterprise API. You configure this key to limit SaaS Security' access to only the scopes it requires. Required permissions: You must be a Company Admin to create the Enterprise API key. |
-
-To onboard your Mural instance, complete the following actions.
-
-***
-
-### Step 1: Identify the Mural Account
-
-Identify the Mural account that you will use to generate the Enterprise API key.
-
-Required permissions: The account that generates the API key must be assigned to the Company Admin role in Mural.
-
-***
-
-### Step 2: Log In to Mural
-
-Open a web browser to the [Mural login page](https://app.mural.co/) and log in to the account you identified.
-
-***
-
-### Step 3: Generate and Copy the Enterprise API Key
-
-1. Navigate to the Company Dashboard in Mural. Locate your avatar in the upper-right corner of the Mural page and select \<your-avatar> > Manage company.
-2. From the Company Dashboard's left-hand navigation pane, select API keys. The API keys item appears under the Development section.
-3. On the API Keys page, click Create API Key. The Create API key dialog prompts you to select the API scopes that the key will authorize SaaS Security to access.
-4. In the Create API key dialog, select the following scopes, which SaaS Security requires:
-
-* Member information
-* User activity logs
-* Reports
-
-5. Click Create API key. Mural generates and displays the Enterprise API key.
-6. Copy the API key and paste it into a text file.
-
-Note: Do not continue to the next step unless you have copied the API key. This is the only time that Mural displays the API key, and you must provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 4: Connect SaaS Security to Your Mural Instance
-
-By adding a Mural app in Cortex, you enable SaaS Security to connect to your Mural instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Mural tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter your API key.
-7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.

▸ Onboard Office 365 deleted +0 −140

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-office-365

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,140 +0,0 @@

---

description: >-

Onboard Office 365 to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Office 365

For SaaS Security to detect posture risks in your Office 365 instance, you must onboard your Office 365 instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Microsoft API and, through the API, scans your Office 365 instance at regular intervals. You can onboard an Office 365 app by using OAuth 2.0 authorization or by using a Microsoft Entra (formerly Azure) service principal.

Note: Connecting to Office 365 enables SaaS Security to scan settings at a high level based on Microsoft's Secure Score. For greater visibility into a particular application in the Office 365 product family, onboard the individual product app. To scan more settings for Microsoft Word, Microsoft PowerPoint, and Microsoft Excel, onboard Office 365 - Productivity Apps. Other products in the Office 365 product family have their own tiles on the Applications page and can be onboarded separately.

Use the method that matches your environment:

• Method 1: OAuth 2.0 Authorization — SaaS Security redirects you to log in to Office 365 and grant access

• Method 2: Service Principal — SaaS Security connects through a Microsoft Entra application you create

### Method 1: OAuth 2.0 Authorization

SaaS Security gets access to your Office 365 instance through OAuth 2.0 authorization. During the onboarding process, you are prompted to log in to Office 365 and to grant SaaS Security the access it requires.

You have the option to connect with read-only permissions or with read and write permissions:

• Read-only permissions enable SaaS Security to perform configuration scans, risky account scans, and third-party plugin scans.

• Read and write permissions enable additional features, including the ability to revoke a user's access to a third-party plugin, force a user out of their current SaaS application sessions from the Identity Security dashboard, and revoke a meeting bot's access to calendar applications from the Meetings dashboard.

Required Permissions: The account must be assigned to the Global Administrator role.

#### Step 1: Identify the Account for Granting SaaS Security Access

1. Identify the Office 365 account that you will use to log in to Office 365 during onboarding. SaaS Security uses this account to establish a connection to your Office 365 instance.

2. Log out of all Microsoft accounts. Logging out helps ensure that you log in under the correct account during the onboarding process. To prevent the browser from using saved credentials, you can open Cortex in an incognito window.

#### Step 2: Connect SaaS Security to Your Office 365 Instance (OAuth 2.0)

By adding an Office 365 app in Cortex, you enable SaaS Security to connect to your Office 365 instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Office 365 tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write permissions. The onboarding page lists the API scopes that SaaS Security will access.

7. Click Connect with Office 365. SaaS Security redirects you to the Office 365 login page.

8. Enter the credentials for the Microsoft account you identified and sign in to Office 365. Microsoft displays a consent form that details the access permissions that SaaS Security requires.

9. Review the consent form and allow the requested permissions. SaaS Security connects to your Office 365 instance and displays whether it was able to access the API scopes required for its scans and actions.

### Method 2: Service Principal

SaaS Security gets access to your Office 365 instance through a Microsoft Entra service principal, which represents a Microsoft Entra application that you create. You configure the application's permissions to give SaaS Security access to the API scopes it requires.

To onboard your Office 365 instance using a service principal, SaaS Security requires the following information.

Item│Description

| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Tenant ID│A globally unique identifier (GUID) for your Microsoft Entra tenant.

Client ID│SaaS Security accesses a Microsoft API through a Microsoft Entra service principal that represents an application that you create. Microsoft Entra generates the client ID to uniquely identify the application and its associated service principal.

Client Secret│SaaS Security accesses a Microsoft API through a Microsoft Entra service principal that represents an application that you create. Microsoft Entra generates the client secret, which SaaS Security uses to authenticate to the service principal.

Required Permissions: The administrator must be able to grant access to the API scopes required by SaaS Security. These scopes differ depending on whether you want to grant read-only or read and write permissions.

Note: After SaaS Security connects to your Office 365 instance, it performs an initial scan and then runs scans at regular intervals. The service principal must remain available for scans to continue. If you delete the service principal, scans will fail and you will need to onboard Office 365 again.

#### Step 1: Log In to the Microsoft Entra Admin Center

1. Open a web browser to the Microsoft Entra admin center.

2. Log in to the administrator account.

#### Step 2: Create and Register Your Microsoft Entra Application

1. From the left navigation pane, select Enterprise applications.

2. On the Enterprise applications page, select New application.

3. On the All applications page, select Create your own application.

4. On the Create your own application flyout dialog, complete the following actions:

5. Specify a name for the application.

6. Select Register an application to integrate with Microsoft Entra ID (App you're developing).

7. Click Create.

8. On the Register an application window:

9. For supported account types, select Accounts in this organizational directory only.

10. Click Register. Registering the application automatically creates its associated service principal.

#### Step 3: Identify the Required API Scopes from Cortex

To configure the correct API permissions, first retrieve the required scopes from the SaaS Security onboarding screen.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the Office 365 tile.

3. Under Capabilities, enter a name and select Security Posture, then click Next.

4. Select the option for Service Principal. The onboarding page lists the API scopes that SaaS Security requires for read access and for read and write access. Copy the API scopes that you want to allow. Note: Do not continue to the next step unless you have copied the permissions. You will add these permissions to your application.

5. Click Cancel Onboarding. You will complete the onboarding process after you finish configuring your application.

#### Step 4: Configure API Permissions for Your Application

1. From the left navigation pane in the Microsoft Entra admin center, select Enterprise applications.

2. From the list of applications on the All applications page, open your application.

3. From the details page for your application, select Permissions.

4. On the Permissions page, click the Application registration link to go to the API permissions page.

5. On the API permissions page, click Add a permission.

6. On the Request API permissions flyout dialog, select Microsoft Graph > Application Permissions.

7. Select each of the API scopes that you obtained from the Office 365 onboarding screen in Cortex and click Add permissions.

8. On the API permissions page, verify that all the scopes were added as application permissions. The scopes you added should all have a type of Application. Only the User.Read permission (added automatically by Microsoft Entra) will have a type of Delegated.

9. On the API permissions page, select Grant admin consent for your organization.

#### Step 5: Copy the Application Credentials and Tenant ID

1. Copy the client ID:

1. From the details page for your application, select Overview.

2. Copy the client ID from the Application (client) ID field and paste it into a text file.

Note: Do not continue to the next step unless you have copied the client ID. You will provide this information to SaaS Security during the onboarding process.

2. Create and copy the client secret:

1. From the details page for your application, select Certificates & secrets > Client secrets.

2. Create a New client secret.

3. Copy the Value of the new client secret and paste it into a text file.

Note: Do not continue to the next step unless you have copied the client secret. You will provide this information to SaaS Security during the onboarding process.

3. Copy the tenant ID:

1. From the left navigation pane in the Microsoft Entra admin center, select Home.

2. Copy the tenant ID and paste it into a text file.

Note: Do not continue to the next step unless you have copied your tenant ID. You will provide this information to SaaS Security during the onboarding process.

#### Step 6: Connect SaaS Security to Your Office 365 Instance (Service Principal)

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Office 365 tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Select the option for Service Principal.

7. Under Connections, enter the Client ID, Client Secret, and Tenant ID.

8. Depending on the API permissions that you configured for your application, specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write Permissions.

9. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

10. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,140 +0,0 @@
----
-description: >-
-  Onboard Office 365 to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Office 365
-
-For SaaS Security to detect posture risks in your Office 365 instance, you must onboard your Office 365 instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Microsoft API and, through the API, scans your Office 365 instance at regular intervals. You can onboard an Office 365 app by using OAuth 2.0 authorization or by using a Microsoft Entra (formerly Azure) service principal.
-
-**Note**: Connecting to Office 365 enables SaaS Security to scan settings at a high level based on Microsoft's Secure Score. For greater visibility into a particular application in the Office 365 product family, onboard the individual product app. To scan more settings for Microsoft Word, Microsoft PowerPoint, and Microsoft Excel, onboard Office 365 - Productivity Apps. Other products in the Office 365 product family have their own tiles on the Applications page and can be onboarded separately.
-
-Use the method that matches your environment:
-
-* [Method 1: OAuth 2.0 Authorization](https://docs.google.com/document/d/1EIc1VvKe4SEe6D7jGSeIc_PI5JdhlR6qPPcPrU8Mj70/edit#method-1-oauth-20-authorization) — SaaS Security redirects you to log in to Office 365 and grant access
-* [Method 2: Service Principal](https://docs.google.com/document/d/1EIc1VvKe4SEe6D7jGSeIc_PI5JdhlR6qPPcPrU8Mj70/edit#method-2-service-principal) — SaaS Security connects through a Microsoft Entra application you create
-
-***
-
-### Method 1: OAuth 2.0 Authorization
-
-SaaS Security gets access to your Office 365 instance through OAuth 2.0 authorization. During the onboarding process, you are prompted to log in to Office 365 and to grant SaaS Security the access it requires.
-
-You have the option to connect with read-only permissions or with read and write permissions:
-
-* Read-only permissions enable SaaS Security to perform configuration scans, risky account scans, and third-party plugin scans.
-* Read and write permissions enable additional features, including the ability to revoke a user's access to a third-party plugin, force a user out of their current SaaS application sessions from the Identity Security dashboard, and revoke a meeting bot's access to calendar applications from the Meetings dashboard.
-
-Required Permissions: The account must be assigned to the Global Administrator role.
-
-#### Step 1: Identify the Account for Granting SaaS Security Access
-
-1. Identify the Office 365 account that you will use to log in to Office 365 during onboarding. SaaS Security uses this account to establish a connection to your Office 365 instance.
-2. Log out of all Microsoft accounts. Logging out helps ensure that you log in under the correct account during the onboarding process. To prevent the browser from using saved credentials, you can open Cortex in an incognito window.
-
-#### Step 2: Connect SaaS Security to Your Office 365 Instance (OAuth 2.0)
-
-By adding an Office 365 app in Cortex, you enable SaaS Security to connect to your Office 365 instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Office 365 tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write permissions. The onboarding page lists the API scopes that SaaS Security will access.
-7. Click Connect with Office 365. SaaS Security redirects you to the Office 365 login page.
-8. Enter the credentials for the Microsoft account you identified and sign in to Office 365. Microsoft displays a consent form that details the access permissions that SaaS Security requires.
-9. Review the consent form and allow the requested permissions. SaaS Security connects to your Office 365 instance and displays whether it was able to access the API scopes required for its scans and actions.
-
-***
-
-### Method 2: Service Principal
-
-SaaS Security gets access to your Office 365 instance through a Microsoft Entra service principal, which represents a Microsoft Entra application that you create. You configure the application's permissions to give SaaS Security access to the API scopes it requires.
-
-To onboard your Office 365 instance using a service principal, SaaS Security requires the following information.
-
-| Item          | Description                                                                                                                                                                                                                                           |
-| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Tenant ID     | A globally unique identifier (GUID) for your Microsoft Entra tenant.                                                                                                                                                                                  |
-| Client ID     | SaaS Security accesses a Microsoft API through a Microsoft Entra service principal that represents an application that you create. Microsoft Entra generates the client ID to uniquely identify the application and its associated service principal. |
-| Client Secret | SaaS Security accesses a Microsoft API through a Microsoft Entra service principal that represents an application that you create. Microsoft Entra generates the client secret, which SaaS Security uses to authenticate to the service principal.    |
-
-Required Permissions: The administrator must be able to grant access to the API scopes required by SaaS Security. These scopes differ depending on whether you want to grant read-only or read and write permissions.
-
-**Note**: After SaaS Security connects to your Office 365 instance, it performs an initial scan and then runs scans at regular intervals. The service principal must remain available for scans to continue. If you delete the service principal, scans will fail and you will need to onboard Office 365 again.
-
-#### Step 1: Log In to the Microsoft Entra Admin Center
-
-1. Open a web browser to the [Microsoft Entra admin center](https://entra.microsoft.com).
-2. Log in to the administrator account.
-
-#### Step 2: Create and Register Your Microsoft Entra Application
-
-1. From the left navigation pane, select Enterprise applications.
-2. On the Enterprise applications page, select New application.
-3. On the All applications page, select Create your own application.
-4. On the Create your own application flyout dialog, complete the following actions:
-5. Specify a name for the application.
-6. Select Register an application to integrate with Microsoft Entra ID (App you're developing).
-7. Click Create.
-8. On the Register an application window:
-9. For supported account types, select Accounts in this organizational directory only.
-10. Click Register. Registering the application automatically creates its associated service principal.
-
-#### Step 3: Identify the Required API Scopes from Cortex
-
-To configure the correct API permissions, first retrieve the required scopes from the SaaS Security onboarding screen.
-
-1. Log in to Cortex.
-2. Select Settings > Data Sources and Integrations > Add New and click the Office 365 tile.
-3. Under Capabilities, enter a name and select Security Posture, then click Next.
-4. Select the option for Service Principal. The onboarding page lists the API scopes that SaaS Security requires for read access and for read and write access. Copy the API scopes that you want to allow. **Note**: Do not continue to the next step unless you have copied the permissions. You will add these permissions to your application.
-5. Click Cancel Onboarding. You will complete the onboarding process after you finish configuring your application.
-
-#### Step 4: Configure API Permissions for Your Application
-
-1. From the left navigation pane in the Microsoft Entra admin center, select Enterprise applications.
-2. From the list of applications on the All applications page, open your application.
-3. From the details page for your application, select Permissions.
-4. On the Permissions page, click the Application registration link to go to the API permissions page.
-5. On the API permissions page, click Add a permission.
-6. On the Request API permissions flyout dialog, select Microsoft Graph > Application Permissions.
-7. Select each of the API scopes that you obtained from the Office 365 onboarding screen in Cortex and click Add permissions.
-8. On the API permissions page, verify that all the scopes were added as application permissions. The scopes you added should all have a type of Application. Only the User.Read permission (added automatically by Microsoft Entra) will have a type of Delegated.
-9. On the API permissions page, select Grant admin consent for your organization.
-
-#### Step 5: Copy the Application Credentials and Tenant ID
-
-1. Copy the client ID:
-   1. From the details page for your application, select Overview.
-   2. Copy the client ID from the Application (client) ID field and paste it into a text file.
-
-Note: Do not continue to the next step unless you have copied the client ID. You will provide this information to SaaS Security during the onboarding process.
-
-2. Create and copy the client secret:
-   1. From the details page for your application, select Certificates & secrets > Client secrets.
-   2. Create a New client secret.
-   3. Copy the Value of the new client secret and paste it into a text file.
-
-Note: Do not continue to the next step unless you have copied the client secret. You will provide this information to SaaS Security during the onboarding process.
-
-3. Copy the tenant ID:
-   1. From the left navigation pane in the Microsoft Entra admin center, select Home.
-   2. Copy the tenant ID and paste it into a text file.
-
-**Note**: Do not continue to the next step unless you have copied your tenant ID. You will provide this information to SaaS Security during the onboarding process.
-
-#### Step 6: Connect SaaS Security to Your Office 365 Instance (Service Principal)
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Office 365 tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Select the option for Service Principal.
-7. Under **Connections**, enter the Client ID, Client Secret, and Tenant ID.
-8. Depending on the API permissions that you configured for your application, specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write Permissions.
-9. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-10. Click **Next** to complete the onboarding validation process.

▸ Onboard Okta deleted +0 −64

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-okta

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,64 +0,0 @@

---

description: >-

Onboard Okta to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Okta

For SaaS Security to detect posture risks in your Okta instance, you must onboard your Okta instance to SaaS Security. Through the onboarding process, SaaS Security connects to an Okta API by using an API token that you generate from Okta's administrator console. After connecting to the Okta API, SaaS Security scans your Okta instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

During onboarding, SaaS Security gives you an option to connect with read-only permissions or with read and write permissions:

• Read-only permissions enable SaaS Security to perform read-only scans.

• Read and write permissions enable additional actions, such as automated remediation.

After SaaS Security establishes a connection to your Okta instance, it notifies you if it was unable to access certain API scopes. SaaS Security might not be able to access certain scopes if the user who created the API token lacked the required permissions.

To onboard your Okta instance, complete the following actions:

• Create an API token for connecting to your Okta instance

• Connect SaaS Security to your Okta instance

### Step 1: Create an API Token for Connecting to Your Okta Instance

To access your Okta instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

API Token│A generated character string that identifies an Okta administrator to the Okta API. SaaS Security requires this API token to authenticate to the API. The token inherits the permissions of the administrator who creates it. Required permissions: For read and write access, the API token must be created by a Super Administrator. For read-only access, the API token can be created by a read-only administrator.

Admin Instance URL│The URL for your administrator console.

As you complete the following steps, make note of the values of the items described in the preceding table. You will enter these values during onboarding to enable SaaS Security to access your Okta instance.

1. Identify the Okta administrator account that you will use to create your API token. The API token inherits the permissions of the administrator who creates it. For read and write access, create the token as a Super Administrator. For read-only access, create the token as a read-only administrator.

2. Using the administrator account that you identified, log in to your Okta administrator console.

3. Identify your administrator instance URL, which appears in the browser's address bar. Your administrator instance URL is your subdomain plus -admin.okta.com (format: https://<subdomain>-admin.okta.com).

Note: Before you continue to the next step, make note of your administrator instance URL. You will provide this information to SaaS Security during the onboarding process.

4. In the left navigation pane, select Security > API.

5. On the API page, select the Tokens tab.

6. Click Create token. A dialog opens prompting you to name your token.

7. Specify a name for your token and click Create token. Okta generates and displays your token.

8. Copy the generated token and paste it into a text file.

Note: Do not continue to the next step unless you have copied the API token. You will provide this token to SaaS Security during the onboarding process.

### Step 2: Connect SaaS Security to Your Okta Instance

By adding an Okta app in Cortex, you enable SaaS Security to connect to your Okta instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Okta tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter your API token and your administrator instance URL.

7. Specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write permissions. The onboarding page lists the API scopes that SaaS Security will access to complete its various scans and to perform remediation.

8. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

9. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,64 +0,0 @@
----
-description: >-
-  Onboard Okta to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Okta
-
-For SaaS Security to detect posture risks in your Okta instance, you must onboard your Okta instance to SaaS Security. Through the onboarding process, SaaS Security connects to an Okta API by using an API token that you generate from Okta's administrator console. After connecting to the Okta API, SaaS Security scans your Okta instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-During onboarding, SaaS Security gives you an option to connect with read-only permissions or with read and write permissions:
-
-* Read-only permissions enable SaaS Security to perform read-only scans.
-* Read and write permissions enable additional actions, such as automated remediation.
-
-After SaaS Security establishes a connection to your Okta instance, it notifies you if it was unable to access certain API scopes. SaaS Security might not be able to access certain scopes if the user who created the API token lacked the required permissions.
-
-To onboard your Okta instance, complete the following actions:
-
-* Create an API token for connecting to your Okta instance
-* Connect SaaS Security to your Okta instance
-
-***
-
-### Step 1: Create an API Token for Connecting to Your Okta Instance
-
-To access your Okta instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item               | Description                                                                                                                                                                                                                                                                                                                                                                                                             |
-| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| API Token          | A generated character string that identifies an Okta administrator to the Okta API. SaaS Security requires this API token to authenticate to the API. The token inherits the permissions of the administrator who creates it. Required permissions: For read and write access, the API token must be created by a Super Administrator. For read-only access, the API token can be created by a read-only administrator. |
-| Admin Instance URL | The URL for your administrator console.                                                                                                                                                                                                                                                                                                                                                                                 |
-
-As you complete the following steps, make note of the values of the items described in the preceding table. You will enter these values during onboarding to enable SaaS Security to access your Okta instance.
-
-1. Identify the Okta administrator account that you will use to create your API token. The API token inherits the permissions of the administrator who creates it. For read and write access, create the token as a Super Administrator. For read-only access, create the token as a read-only administrator.
-2. Using the administrator account that you identified, log in to your Okta administrator console.
-3. Identify your administrator instance URL, which appears in the browser's address bar. Your administrator instance URL is your subdomain plus -admin.okta.com (format: https://\<subdomain>-admin.okta.com).
-
-**Note**: Before you continue to the next step, make note of your administrator instance URL. You will provide this information to SaaS Security during the onboarding process.
-
-4. In the left navigation pane, select Security > API.
-5. On the API page, select the Tokens tab.
-6. Click Create token. A dialog opens prompting you to name your token.
-7. Specify a name for your token and click Create token. Okta generates and displays your token.
-8. Copy the generated token and paste it into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the API token. You will provide this token to SaaS Security during the onboarding process.
-
-***
-
-### Step 2: Connect SaaS Security to Your Okta Instance
-
-By adding an Okta app in Cortex, you enable SaaS Security to connect to your Okta instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Okta tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter your API token and your administrator instance URL.
-7. Specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write permissions. The onboarding page lists the API scopes that SaaS Security will access to complete its various scans and to perform remediation.
-8. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
-9. Click **Next** to complete the onboarding validation process.

▸ Onboard PagerDuty deleted +0 −70

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-pagerduty

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,70 +0,0 @@

---

description: >-

Onboard PagerDuty to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard PagerDuty

For SaaS Security to detect posture risks in your PagerDuty instance, you must onboard your PagerDuty instance to SaaS Security. Through the onboarding process, SaaS Security logs in to PagerDuty using administrator account credentials. SaaS Security uses this account to scan your PagerDuty instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

To onboard your PagerDuty instance, complete the following actions:

• Collect information for accessing your PagerDuty instance

• Connect SaaS Security to your PagerDuty instance

### Step 1: Collect Information for Accessing Your PagerDuty Instance

To access your PagerDuty instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ------------------- | ------------------------------------------------------------------------------------------------------------------------------- |

User│The username or email address of the administrator account. Required Permissions: The user must be the PagerDuty Account Owner.

Password│The password for the administrator account.

PagerDuty Subdomain│If your account has a personalized PagerDuty subdomain, the name of the subdomain.

Region│PagerDuty manages data centers in different geographical regions. You must specify your service region.

If you are using Okta as your identity provider, you must also provide:

Item│Description

| --------------- | ------------------------------------------------------------------------------------------------------------ |

Okta subdomain│The Okta subdomain for your organization, included in the login URL that Okta assigned to your organization.

Okta 2FA secret│A key used to generate one-time passcodes for MFA.

If you are using Azure Active Directory (AD) as your identity provider, you must also provide:

Item│Description

| ---------------- | -------------------------------------------------- |

Azure 2FA secret│A key used to generate one-time passcodes for MFA.

As you complete the following steps, make note of the values of the items described in the preceding tables. You will need to enter these values during onboarding to access your PagerDuty instance from SaaS Security.

1. Identify the administrator account that SaaS Security will use to access your PagerDuty instance. The administrator must be the PagerDuty Account Owner. SaaS Security needs Account Owner permissions to monitor your PagerDuty instance.

2. Determine whether you want SaaS Security to log in to the administrator account directly, or through an identity provider. Using an identity provider adds an extra layer of security by requiring MFA using one-time passcodes. You can use Okta or Microsoft Azure as the identity provider.

• (For Okta login): Identify your Okta subdomain, then generate and copy an MFA secret key.

• (For Microsoft Azure login): Enable third-party software OATH tokens for the administrator account, then configure the account for MFA and copy the MFA secret key.

3. Determine if your organization has a personalized PagerDuty subdomain. You can determine this from your PagerDuty URL. If you have a personalized subdomain, it is prepended to your PagerDuty URL (for example, <subdomain>.pagerduty.com).

Note: If you have a personalized subdomain, make note of it before you continue to the next step. You must provide this information to SaaS Security during the onboarding process. If you do not have a personalized subdomain, leave the associated field blank during the onboarding process.

4. Make note of your PagerDuty service region, which you can determine from your PagerDuty URL after you log in to your account. If the URL contains the string eu, your region is the European Union (EU). If the URL does not contain a region code, your region is the United States (US).

### Step 2: Connect SaaS Security to Your PagerDuty Instance

By adding a PagerDuty app in Cortex, you enable SaaS Security to connect to your PagerDuty instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the PagerDuty tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, specify how you want SaaS Security to connect to your PagerDuty instance: Log in with Credentials, Log in with Okta, or Log in with Azure.

7. When prompted, provide SaaS Security with the administrator credentials, PagerDuty subdomain, and PagerDuty service region. If you do not have a personalized subdomain, leave the PagerDuty subdomain field blank. If SaaS Security is connecting through an identity provider, specify the information needed for MFA.

8. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

9. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,70 +0,0 @@
----
-description: >-
-  Onboard PagerDuty to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard PagerDuty
-
-For SaaS Security to detect posture risks in your PagerDuty instance, you must onboard your PagerDuty instance to SaaS Security. Through the onboarding process, SaaS Security logs in to PagerDuty using administrator account credentials. SaaS Security uses this account to scan your PagerDuty instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.
-
-To onboard your PagerDuty instance, complete the following actions:
-
-* Collect information for accessing your PagerDuty instance
-* Connect SaaS Security to your PagerDuty instance
-
-***
-
-### Step 1: Collect Information for Accessing Your PagerDuty Instance
-
-To access your PagerDuty instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item                | Description                                                                                                                     |
-| ------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| User                | The username or email address of the administrator account. Required Permissions: The user must be the PagerDuty Account Owner. |
-| Password            | The password for the administrator account.                                                                                     |
-| PagerDuty Subdomain | If your account has a personalized PagerDuty subdomain, the name of the subdomain.                                              |
-| Region              | PagerDuty manages data centers in different geographical regions. You must specify your service region.                         |
-
-If you are using Okta as your identity provider, you must also provide:
-
-| Item            | Description                                                                                                  |
-| --------------- | ------------------------------------------------------------------------------------------------------------ |
-| Okta subdomain  | The Okta subdomain for your organization, included in the login URL that Okta assigned to your organization. |
-| Okta 2FA secret | A key used to generate one-time passcodes for MFA.                                                           |
-
-If you are using Azure Active Directory (AD) as your identity provider, you must also provide:
-
-| Item             | Description                                        |
-| ---------------- | -------------------------------------------------- |
-| Azure 2FA secret | A key used to generate one-time passcodes for MFA. |
-
-As you complete the following steps, make note of the values of the items described in the preceding tables. You will need to enter these values during onboarding to access your PagerDuty instance from SaaS Security.
-
-1. Identify the administrator account that SaaS Security will use to access your PagerDuty instance. The administrator must be the PagerDuty Account Owner. SaaS Security needs Account Owner permissions to monitor your PagerDuty instance.
-2. Determine whether you want SaaS Security to log in to the administrator account directly, or through an identity provider. Using an identity provider adds an extra layer of security by requiring MFA using one-time passcodes. You can use Okta or Microsoft Azure as the identity provider.
-
-* (For Okta login): Identify your Okta subdomain, then generate and copy an MFA secret key.
-* (For Microsoft Azure login): Enable third-party software OATH tokens for the administrator account, then configure the account for MFA and copy the MFA secret key.
-
-3. Determine if your organization has a personalized PagerDuty subdomain. You can determine this from your PagerDuty URL. If you have a personalized subdomain, it is prepended to your PagerDuty URL (for example, \<subdomain>.pagerduty.com).
-
-**Note**: If you have a personalized subdomain, make note of it before you continue to the next step. You must provide this information to SaaS Security during the onboarding process. If you do not have a personalized subdomain, leave the associated field blank during the onboarding process.
-
-4. Make note of your PagerDuty service region, which you can determine from your PagerDuty URL after you log in to your account. If the URL contains the string eu, your region is the European Union (EU). If the URL does not contain a region code, your region is the United States (US).
-
-***
-
-### Step 2: Connect SaaS Security to Your PagerDuty Instance
-
-By adding a PagerDuty app in Cortex, you enable SaaS Security to connect to your PagerDuty instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the PagerDuty tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, specify how you want SaaS Security to connect to your PagerDuty instance: Log in with Credentials, Log in with Okta, or Log in with Azure.
-7. When prompted, provide SaaS Security with the administrator credentials, PagerDuty subdomain, and PagerDuty service region. If you do not have a personalized subdomain, leave the PagerDuty subdomain field blank. If SaaS Security is connecting through an identity provider, specify the information needed for MFA.
-8. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
-9. Click **Next** to complete the onboarding validation process.

▸ Onboard Redis Labs deleted +0 −150

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-redis-labs

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,150 +0,0 @@

---

description: >-

Onboard Redis Labs to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Redis Labs

For SaaS Security to detect posture risks in your Redis Labs instance, you must onboard your Redis Labs instance to SaaS Security. Through the onboarding process, SaaS Security connects to the Redis Cloud REST API by using a pair of API keys that you generate within Redis Labs. After connecting to the Redis Cloud REST API, SaaS Security scans your Redis Labs instance for misconfigured settings and account risks.

To onboard your Redis Labs instance, SaaS Security requires the following information, which you specify during the onboarding process.

Item│Description

| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Account key│An API account key that Redis Labs generates the first time a Redis Labs account owner enables the REST API. The API account key is an alphanumeric string that uniquely identifies your Redis Labs account. SaaS Security uses this key and the API user key to authenticate to a Redis Labs API.

User key│An API user key that you create in Redis Labs and associate with a particular user. SaaS Security uses this key to authenticate to a Redis Labs API. Redis Labs authorizes requests from SaaS Security based on the key's role, which it inherits from the user associated with the key.

To onboard your Redis Labs instance, complete the following actions.

### Step 1: Identify the Redis Labs Owner Account

Identify the Redis Labs user who will get the API account key and API user key.

Required Permissions: The user must be assigned to the Owner role in Redis Labs. The Owner role is required to enable the Redis Cloud REST API and to create an API user key.

### Step 2: Log In to Redis Labs

Open a web browser to the Redis Labs login page and log in as the Owner you identified.

### Step 3: Locate and Copy Your API Account Key

Redis Labs generates a unique API account key the first time a Redis Labs account Owner enables the REST API. This API account key appears on the Access Management page.

1. From the left navigation pane, select Access Management.

2. On the Access Management page, select the API Keys tab. If another Owner previously enabled the API, the API account key appears on this page. Otherwise, the page contains an Enable API button.

3. If necessary, click Enable API.

4. Copy the API account key and paste it into a text file.

Note: Do not continue to the next step unless you have copied the API account key. You will provide this key to SaaS Security during the onboarding process.

### Step 4: Create and Copy an API User Key

When you create an API user key, you associate the key with a specific Redis Labs user. The key's permissions are based on the associated user's role.

1. On the Access Management page's API Keys tab, locate the API User Keys section.

2. In the API User Keys section, click the add button (+). Redis Labs displays an empty entry for you to configure your API user key.

3. In the empty entry, complete the following actions:

1. Specify an API key name. For effective logging, auditing, and future maintenance, supply a descriptive name that clearly identifies the purpose of the key. For example, SaaS Security-integration.

2. Select a User name from the list. The user you select must be assigned to the Owner role.

3. Click Create. Redis Labs generates and displays your API user key.

4. Copy the API user key and paste it into a text file.

Note: Do not continue to the next step unless you have copied the API user key. You will provide this key to SaaS Security during the onboarding process.

### Step 5: Connect SaaS Security to Your Redis Labs Instance

By adding a Redis Labs app in Cortex, you enable SaaS Security to connect to your Redis Labs instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Redis Labs tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Under Connections, enter your API account key and API user key.

7. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

8. Click Next to complete the onboarding validation process.

#### Onboard a Redis Labs App to SaaS Security

Connect a Redis Labs instance to SaaS Security to detect posture risks.

SaaS Security connects to the Redis Cloud REST API using a pair of API keys that you generate in Redis Labs. After connecting, SaaS Security scans your Redis Labs instance for misconfigured settings and account risks.

The onboarding process requires the following credentials:

Item│Description

| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Account key│An API account key that Redis Labs generates the first time an account Owner enables the REST API. This alphanumeric string uniquely identifies your Redis Labs account.

User key│An API user key that you create in Redis Labs and associate with a specific user. Redis Labs authorizes requests based on the key's role, which it inherits from the associated user.

#### Step 1 — Identify the Owner account

Identify the Redis Labs user who will retrieve the API account key and create the API user key.

Required permissions: The user must be assigned the Owner role in Redis Labs. The Owner role is required to enable the Redis Cloud REST API and to create an API user key.

#### Step 2 — Log in to Redis Labs

Open a browser to app.redislabs.com and log in as the Owner you identified in Step 1.

#### Step 3 — Get the API account key

Redis Labs generates a unique API account key the first time an account Owner enables the REST API. The key appears on the Access Management page.

1. From the left navigation pane, select Access Management.

2. Select the API Keys tab.

3. If another Owner previously enabled the API, the account key appears on this page.

4. If not, click Enable API to generate the key.

5. If necessary, click Enable API.

6. Copy the API account key and save it to a text file.

Note: Do not proceed to the next step until you have copied the API account key. You will provide this key during the onboarding process.

#### Step 4 — Create an API user key

When you create an API user key, you associate it with a specific Redis Labs user. The key's permissions are based on that user's role.

1. On the Access Management page, select the API Keys tab.

2. In the API User Keys section, click the + (add) button. Redis Labs displays an empty entry for you to configure.

3. Complete the following fields:

4. API key name — Enter a descriptive name that identifies the key's purpose. For example, SaaS-Security-integration.

5. User name — Select a user assigned to the Owner role.

6. Click Create. Redis Labs generates and displays the API user key.

7. Copy the API user key and save it to a text file.

Note: Do not proceed to the next step until you have copied the API user key. You will provide this key during the onboarding process.

#### Step 5 — Connect SaaS Security to Redis Labs

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the Redis Labs tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, enter your API account key and API user key.

7. Click Next.

8. On the Configurations tab:

1. Set the Sync Interval.

2. (Optional) Add a Tag.

9. Click Next to complete onboarding.

Show markdown source

@@ -1,150 +0,0 @@
----
-description: >-
-  Onboard Redis Labs to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Redis Labs
-
-For SaaS Security to detect posture risks in your Redis Labs instance, you must onboard your Redis Labs instance to SaaS Security. Through the onboarding process, SaaS Security connects to the Redis Cloud REST API by using a pair of API keys that you generate within Redis Labs. After connecting to the Redis Cloud REST API, SaaS Security scans your Redis Labs instance for misconfigured settings and account risks.
-
-To onboard your Redis Labs instance, SaaS Security requires the following information, which you specify during the onboarding process.
-
-| Item        | Description                                                                                                                                                                                                                                                                                        |
-| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Account key | An API account key that Redis Labs generates the first time a Redis Labs account owner enables the REST API. The API account key is an alphanumeric string that uniquely identifies your Redis Labs account. SaaS Security uses this key and the API user key to authenticate to a Redis Labs API. |
-| User key    | An API user key that you create in Redis Labs and associate with a particular user. SaaS Security uses this key to authenticate to a Redis Labs API. Redis Labs authorizes requests from SaaS Security based on the key's role, which it inherits from the user associated with the key.           |
-
-To onboard your Redis Labs instance, complete the following actions.
-
-***
-
-### Step 1: Identify the Redis Labs Owner Account
-
-Identify the Redis Labs user who will get the API account key and API user key.
-
-Required Permissions: The user must be assigned to the Owner role in Redis Labs. The Owner role is required to enable the Redis Cloud REST API and to create an API user key.
-
-***
-
-### Step 2: Log In to Redis Labs
-
-Open a web browser to [the Redis Labs login page](https://app.redislabs.com/#/login) and log in as the Owner you identified.
-
-***
-
-### Step 3: Locate and Copy Your API Account Key
-
-Redis Labs generates a unique API account key the first time a Redis Labs account Owner enables the REST API. This API account key appears on the Access Management page.
-
-1. From the left navigation pane, select Access Management.
-2. On the Access Management page, select the API Keys tab. If another Owner previously enabled the API, the API account key appears on this page. Otherwise, the page contains an Enable API button.
-3. If necessary, click Enable API.
-4. Copy the API account key and paste it into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the API account key. You will provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 4: Create and Copy an API User Key
-
-When you create an API user key, you associate the key with a specific Redis Labs user. The key's permissions are based on the associated user's role.
-
-1. On the Access Management page's API Keys tab, locate the API User Keys section.
-2. In the API User Keys section, click the add button (+). Redis Labs displays an empty entry for you to configure your API user key.
-3. In the empty entry, complete the following actions:
-   1. Specify an API key name. For effective logging, auditing, and future maintenance, supply a descriptive name that clearly identifies the purpose of the key. For example, SaaS Security-integration.
-   2. Select a User name from the list. The user you select must be assigned to the Owner role.
-   3. Click Create. Redis Labs generates and displays your API user key.
-4. Copy the API user key and paste it into a text file.
-
-**Note**: Do not continue to the next step unless you have copied the API user key. You will provide this key to SaaS Security during the onboarding process.
-
-***
-
-### Step 5: Connect SaaS Security to Your Redis Labs Instance
-
-By adding a Redis Labs app in Cortex, you enable SaaS Security to connect to your Redis Labs instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Redis Labs tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Under **Connections**, enter your API account key and API user key.
-7. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
-8. Click **Next** to complete the onboarding validation process.
-
-#### Onboard a Redis Labs App to SaaS Security
-
-Connect a Redis Labs instance to SaaS Security to detect posture risks.
-
-SaaS Security connects to the Redis Cloud REST API using a pair of API keys that you generate in Redis Labs. After connecting, SaaS Security scans your Redis Labs instance for misconfigured settings and account risks.
-
-The onboarding process requires the following credentials:
-
-| Item        | Description                                                                                                                                                                           |
-| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Account key | An API account key that Redis Labs generates the first time an account Owner enables the REST API. This alphanumeric string uniquely identifies your Redis Labs account.              |
-| User key    | An API user key that you create in Redis Labs and associate with a specific user. Redis Labs authorizes requests based on the key's role, which it inherits from the associated user. |
-
-***
-
-#### Step 1 — Identify the Owner account
-
-Identify the Redis Labs user who will retrieve the API account key and create the API user key.
-
-Required permissions: The user must be assigned the Owner role in Redis Labs. The Owner role is required to enable the Redis Cloud REST API and to create an API user key.
-
-***
-
-#### Step 2 — Log in to Redis Labs
-
-Open a browser to [app.redislabs.com](https://app.redislabs.com/#/login) and log in as the Owner you identified in Step 1.
-
-***
-
-#### Step 3 — Get the API account key
-
-Redis Labs generates a unique API account key the first time an account Owner enables the REST API. The key appears on the Access Management page.
-
-1. From the left navigation pane, select Access Management.
-2. Select the API Keys tab.
-3. If another Owner previously enabled the API, the account key appears on this page.
-4. If not, click Enable API to generate the key.
-5. If necessary, click Enable API.
-6. Copy the API account key and save it to a text file.
-
-**Note**: Do not proceed to the next step until you have copied the API account key. You will provide this key during the onboarding process.
-
-***
-
-#### Step 4 — Create an API user key
-
-When you create an API user key, you associate it with a specific Redis Labs user. The key's permissions are based on that user's role.
-
-1. On the Access Management page, select the API Keys tab.
-2. In the API User Keys section, click the + (add) button. Redis Labs displays an empty entry for you to configure.
-3. Complete the following fields:
-4. API key name — Enter a descriptive name that identifies the key's purpose. For example, SaaS-Security-integration.
-5. User name — Select a user assigned to the Owner role.
-6. Click Create. Redis Labs generates and displays the API user key.
-7. Copy the API user key and save it to a text file.
-
-**Note**: Do not proceed to the next step until you have copied the API user key. You will provide this key during the onboarding process.
-
-***
-
-#### Step 5 — Connect SaaS Security to Redis Labs
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select **Settings > Data Sources and Integrations > Add New** and click the Redis Labs tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, enter your API account key and API user key.
-7. Click Next.
-8. On the **Configurations** tab:
-   1. Set the Sync Interval.
-   2. (Optional) Add a Tag.
-9. Click **Next** to complete onboarding.

▸ Onboard Salesforce deleted +0 −123

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-salesforce

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,123 +0,0 @@

---

description: >-

Onboard Salesforce to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Salesforce

For SaaS Security to detect posture risks in your Salesforce instance, you must onboard your Salesforce instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Salesforce API and, through the API, scans your Salesforce instance for misconfigured settings and account risks.

You can onboard your Salesforce instance through an interactive OAuth 2.0 Authorization flow or through a Salesforce External Client App.

• OAuth 2.0 Authorization relies on a Salesforce user account to authorize access through a browser-based login. This approach can be faster to set up and leverages any SSO or MFA requirements already established by your organization.

• External Client App authenticates using application credentials (Client ID and Client Secret), creating a persistent, system-to-system link that does not rely on OAuth refresh tokens.

Use the method that matches your environment:

• Method 1: OAuth 2.0 Authorization

• Method 2: External Client App

### Method 1: OAuth 2.0 Authorization

SaaS Security gets access to your Salesforce instance through OAuth 2.0 authorization. During the onboarding process, you are prompted to log in to Salesforce and to grant SaaS Security the access it requires.

Required information:

Item│Description

| ------------ | --------------------------------------------------------------------------------------------------------- |

Instance URL│The unique web address for your Salesforce instance. Format: https://<instance_name>.my.salesforce.com.

#### Step 1: Identify Your Salesforce Instance URL

Make note of your organization's Salesforce instance (domain) URL. Your instance URL has the format https://<instance_name>.my.salesforce.com. Include the https:// prefix when you provide this URL to SaaS Security.

If necessary, locate your instance URL from the My Domain Settings page:

1. Click the settings icon (gear icon) in the upper-right corner of the page and select Setup.

2. From the Setup page's left navigation pane, select Company Settings > My Domain.

3. The Current My Domain URL field contains your instance URL.

#### Step 2: Identify the Salesforce Account and Configure Permissions

Identify the Salesforce account that you will use to log in to Salesforce during onboarding. We recommend using a dedicated service account. If you delete the service account or change its password, scans will fail and you will need to onboard Salesforce again.

During onboarding, SaaS Security gives you an option to connect with read-only permissions or with read and write permissions.

Permissions for Read Access (configuration scans, identity scans, risky account scans):

Scan Type│Required Permission

| -------------- | ------------------------------------------------------------------------------------------------ |

Configuration│API Enabled, View Health Check

Risky Accounts│API Enabled (plus disable login with Salesforce credentials on the Single Sign-on Settings page)

Identity│API Enabled, View Event Log Files, View Setup and Configuration, View All Users

Additional Permissions for Write Access (third-party plugin scans and automated remediation):

Scan Type / Remediation│Required Permission

| ------------------------- | ------------------------------------------------------------- |

Configuration Remediation│API Enabled, View Health Check, Download AppExchange Packages

Third-Party Plugins│API Enabled, Download AppExchange Packages

To grant permissions to the user account, add the permissions to a permission set and assign the permission set to the Salesforce user account:

1. From the setup home page, select Users > Permission Sets.

2. Create a new permission set or edit an existing one.

3. On the setup page for the permission set, locate the System area and navigate to System Permissions.

4. Enable the required permissions and save.

5. Assign the permission set to the Salesforce user account.

#### Step 3: Install the SaaS Security OAuth App in Salesforce

Important: In September 2025, Salesforce updated its security policy for connected OAuth apps. To onboard or re-authenticate to Salesforce, you must install the SaaS Security OAuth app in Salesforce. You only need to complete this step once per Salesforce instance.

Salesforce now requires connected OAuth apps to be formally installed. Because the SaaS Security connector uses the OAuth 2.0 flow (which creates an uninstalled OAuth app), you must navigate to the Connected Apps OAuth Usage page in Salesforce, locate the SaaS Security uninstalled OAuth app, and install it.

If you have never onboarded Salesforce to SaaS Security, first complete the Connect step below to have Salesforce create the uninstalled connected app, then return to install it.

#### Step 4: Connect SaaS Security to Your Salesforce Instance (OAuth 2.0)

By adding a Salesforce app in Cortex, you enable SaaS Security to connect to your Salesforce instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Salesforce tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Select the option for OAuth 2.0.

7. Enter your Instance URL.

8. Specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write Permissions. The onboarding page lists the API scopes that SaaS Security will access.

9. Click Connect with Salesforce. SaaS Security redirects you to the Salesforce login page.

10. Log in to the Salesforce account. Salesforce displays a consent form that details the access permissions that SaaS Security requires.

11. Review the consent form and allow the requested permissions. SaaS Security connects to your Salesforce instance and displays whether it was able to access the required API scopes.

### Method 2: External Client App

The External Client App approach authenticates using application credentials (Client ID and Client Secret). This method offers long-term stability by creating a persistent, system-to-system link that does not rely on OAuth refresh tokens.

Required information:

Item│Description

| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Instance URL│The unique web address for your Salesforce instance. Format: https://<instance_name>.my.salesforce.com.

Client ID│SaaS Security accesses the Salesforce API through an External Client App that you create in Salesforce. Salesforce generates the Client ID to uniquely identify this app.

Client Secret│SaaS Security accesses the Salesforce API through an External Client App that you create in Salesforce. Salesforce generates the Client Secret, which SaaS Security uses to authenticate to the API.

#### Connect SaaS Security to Your Salesforce Instance (External Client App)

By adding a Salesforce app in Cortex, you enable SaaS Security to connect to your Salesforce instance.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the app you want to connect to.

3. Click the Salesforce tile.

4. Under Capabilities, enter a name for your application.

5. Select Security Posture under Default Capabilities and click Next.

6. Select the option for External Client App.

7. Enter your Instance URL and the application credentials (Client ID and Client Secret).

8. Specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write Permissions. The onboarding page lists the API scopes that SaaS Security will access.

9. Under Configurations, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

10. Click Next to complete the onboarding validation process.

Show markdown source

@@ -1,123 +0,0 @@
----
-description: >-
-  Onboard Salesforce to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Salesforce
-
-For SaaS Security to detect posture risks in your Salesforce instance, you must onboard your Salesforce instance to SaaS Security. Through the onboarding process, SaaS Security connects to a Salesforce API and, through the API, scans your Salesforce instance for misconfigured settings and account risks.
-
-You can onboard your Salesforce instance through an interactive OAuth 2.0 Authorization flow or through a Salesforce External Client App.
-
-* OAuth 2.0 Authorization relies on a Salesforce user account to authorize access through a browser-based login. This approach can be faster to set up and leverages any SSO or MFA requirements already established by your organization.
-* External Client App authenticates using application credentials (Client ID and Client Secret), creating a persistent, system-to-system link that does not rely on OAuth refresh tokens.
-
-Use the method that matches your environment:
-
-* [Method 1: OAuth 2.0 Authorization](https://docs.google.com/document/d/1EIc1VvKe4SEe6D7jGSeIc_PI5JdhlR6qPPcPrU8Mj70/edit#method-1-oauth-20-authorization)
-* [Method 2: External Client App](https://docs.google.com/document/d/1EIc1VvKe4SEe6D7jGSeIc_PI5JdhlR6qPPcPrU8Mj70/edit#method-2-external-client-app)
-
-***
-
-### Method 1: OAuth 2.0 Authorization
-
-SaaS Security gets access to your Salesforce instance through OAuth 2.0 authorization. During the onboarding process, you are prompted to log in to Salesforce and to grant SaaS Security the access it requires.
-
-Required information:
-
-| Item         | Description                                                                                               |
-| ------------ | --------------------------------------------------------------------------------------------------------- |
-| Instance URL | The unique web address for your Salesforce instance. Format: https://\<instance\_name>.my.salesforce.com. |
-
-#### Step 1: Identify Your Salesforce Instance URL
-
-Make note of your organization's Salesforce instance (domain) URL. Your instance URL has the format https://\<instance\_name>.my.salesforce.com. Include the https:// prefix when you provide this URL to SaaS Security.
-
-If necessary, locate your instance URL from the My Domain Settings page:
-
-1. Click the settings icon (gear icon) in the upper-right corner of the page and select Setup.
-2. From the Setup page's left navigation pane, select Company Settings > My Domain.
-3. The Current My Domain URL field contains your instance URL.
-
-#### Step 2: Identify the Salesforce Account and Configure Permissions
-
-Identify the Salesforce account that you will use to log in to Salesforce during onboarding. We recommend using a dedicated service account. If you delete the service account or change its password, scans will fail and you will need to onboard Salesforce again.
-
-During onboarding, SaaS Security gives you an option to connect with read-only permissions or with read and write permissions.
-
-Permissions for Read Access (configuration scans, identity scans, risky account scans):
-
-| Scan Type      | Required Permission                                                                              |
-| -------------- | ------------------------------------------------------------------------------------------------ |
-| Configuration  | API Enabled, View Health Check                                                                   |
-| Risky Accounts | API Enabled (plus disable login with Salesforce credentials on the Single Sign-on Settings page) |
-| Identity       | API Enabled, View Event Log Files, View Setup and Configuration, View All Users                  |
-
-Additional Permissions for Write Access (third-party plugin scans and automated remediation):
-
-| Scan Type / Remediation   | Required Permission                                           |
-| ------------------------- | ------------------------------------------------------------- |
-| Configuration Remediation | API Enabled, View Health Check, Download AppExchange Packages |
-| Third-Party Plugins       | API Enabled, Download AppExchange Packages                    |
-
-To grant permissions to the user account, add the permissions to a permission set and assign the permission set to the Salesforce user account:
-
-1. From the setup home page, select Users > Permission Sets.
-2. Create a new permission set or edit an existing one.
-3. On the setup page for the permission set, locate the System area and navigate to System Permissions.
-4. Enable the required permissions and save.
-5. Assign the permission set to the Salesforce user account.
-
-#### Step 3: Install the SaaS Security OAuth App in Salesforce
-
-Important: In September 2025, Salesforce updated its security policy for connected OAuth apps. To onboard or re-authenticate to Salesforce, you must install the SaaS Security OAuth app in Salesforce. You only need to complete this step once per Salesforce instance.
-
-Salesforce now requires connected OAuth apps to be formally installed. Because the SaaS Security connector uses the OAuth 2.0 flow (which creates an uninstalled OAuth app), you must navigate to the Connected Apps OAuth Usage page in Salesforce, locate the SaaS Security uninstalled OAuth app, and install it.
-
-If you have never onboarded Salesforce to SaaS Security, first complete the Connect step below to have Salesforce create the uninstalled connected app, then return to install it.
-
-#### Step 4: Connect SaaS Security to Your Salesforce Instance (OAuth 2.0)
-
-By adding a Salesforce app in Cortex, you enable SaaS Security to connect to your Salesforce instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Salesforce tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Select the option for OAuth 2.0.
-7. Enter your Instance URL.
-8. Specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write Permissions. The onboarding page lists the API scopes that SaaS Security will access.
-9. Click Connect with Salesforce. SaaS Security redirects you to the Salesforce login page.
-10. Log in to the Salesforce account. Salesforce displays a consent form that details the access permissions that SaaS Security requires.
-11. Review the consent form and allow the requested permissions. SaaS Security connects to your Salesforce instance and displays whether it was able to access the required API scopes.
-
-***
-
-### Method 2: External Client App
-
-The External Client App approach authenticates using application credentials (Client ID and Client Secret). This method offers long-term stability by creating a persistent, system-to-system link that does not rely on OAuth refresh tokens.
-
-Required information:
-
-| Item          | Description                                                                                                                                                                                          |
-| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Instance URL  | The unique web address for your Salesforce instance. Format: https://\<instance\_name>.my.salesforce.com.                                                                                            |
-| Client ID     | SaaS Security accesses the Salesforce API through an External Client App that you create in Salesforce. Salesforce generates the Client ID to uniquely identify this app.                            |
-| Client Secret | SaaS Security accesses the Salesforce API through an External Client App that you create in Salesforce. Salesforce generates the Client Secret, which SaaS Security uses to authenticate to the API. |
-
-#### Connect SaaS Security to Your Salesforce Instance (External Client App)
-
-By adding a Salesforce app in Cortex, you enable SaaS Security to connect to your Salesforce instance.
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
-3. Click the Salesforce tile.
-4. Under **Capabilities**, enter a name for your application.
-5. Select Security Posture under Default Capabilities and click Next.
-6. Select the option for External Client App.
-7. Enter your Instance URL and the application credentials (Client ID and Client Secret).
-8. Specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write Permissions. The onboarding page lists the API scopes that SaaS Security will access.
-9. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
-10. Click **Next** to complete the onboarding validation process.

▸ Onboard SAP Ariba deleted +0 −84

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-sap-ariba

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,84 +0,0 @@

---

description: >-

Onboard SAP Ariba to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard SAP Ariba

SaaS Security connects to your SAP Ariba instance using administrator credentials and your realm name. You can connect directly with credentials or through Microsoft Azure AD (which adds MFA using one-time passcodes).

The onboarding process requires the following information:

Item│Description

| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

Username│The username or email address of an SAP Ariba administrator account. The format depends on whether SaaS Security logs in directly or through an identity provider. The account must be registered to the SAP Ariba realm you want to scan.

Password│The password for the SAP Ariba administrator account.

Realm│The SAP Ariba realm that SaaS Security will scan for misconfigurations.

If SaaS Security accesses the administrator account directly, you also need:

Item│Description

| ---- | ---------------------------------------------------------------------------------------------------- |

FQDN│The fully qualified domain name for connecting to your SAP Ariba instance. For example: s1.ariba.com

If you use Azure Active Directory as your identity provider, you also need:

Item│Description

| ---------------- | -------------------------------------------------- |

Azure 2FA secret│A key used to generate one-time passcodes for MFA.

#### Step 1 — Identify the administrator account

Identify the SAP Ariba account whose login credentials you will supply during onboarding.

Required permissions: The account must have administrator permissions to the SAP Ariba realm you want SaaS Security to scan.

#### Step 2 — Choose a login method

Determine whether you want SaaS Security to log in to the administrator account directly, or through Microsoft Azure AD.

Using Microsoft Azure AD adds an extra layer of security by requiring MFA with one-time passcodes. If you use Azure AD, SaaS Security requires additional information for MFA.

#### Step 3 — (Azure AD login only) Configure MFA

If you are using Microsoft Azure AD as your identity provider:

1. Enable third-party software OATH tokens for the administrator account.

2. Configure the account for MFA and copy the MFA secret key.

#### Step 4 — Identify your realm name and FQDN

1. Log in to your SAP Ariba realm using the administrator account you identified in Step 1. After login, the URL contains a realm query parameter showing your realm name.

2. From the browser address bar, locate the realm parameter in the URL.

3. Make note of the realm name. You will provide this value during onboarding.

4. (Direct login only) Also make note of the fully qualified domain name shown in the browser address bar. During onboarding, you will select the FQDN from a list. Possible values include s1.ariba.com and s3.ariba.com.

#### Step 5 — Connect SaaS Security to SAP Ariba

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the SAP Ariba tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, select how SaaS Security will connect:

1. Log in with Credentials — for direct login

2. Log in with Azure — for Azure AD login

7. When prompted, provide the administrator credentials and your realm name.

8. Direct login: Select the FQDN for your SAP Ariba instance.

9. Azure AD login: Provide the Azure 2FA secret for MFA.

10. Click Next.

11. On the Configurations tab:

1. Set the Sync Interval.

2. (Optional) Add a Tag.

12. Click Next to complete onboarding.

Show markdown source

@@ -1,84 +0,0 @@
----
-description: >-
-  Onboard SAP Ariba to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard SAP Ariba
-
-SaaS Security connects to your SAP Ariba instance using administrator credentials and your realm name. You can connect directly with credentials or through Microsoft Azure AD (which adds MFA using one-time passcodes).
-
-The onboarding process requires the following information:
-
-| Item     | Description                                                                                                                                                                                                                                |
-| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Username | The username or email address of an SAP Ariba administrator account. The format depends on whether SaaS Security logs in directly or through an identity provider. The account must be registered to the SAP Ariba realm you want to scan. |
-| Password | The password for the SAP Ariba administrator account.                                                                                                                                                                                      |
-| Realm    | The SAP Ariba realm that SaaS Security will scan for misconfigurations.                                                                                                                                                                    |
-
-If SaaS Security accesses the administrator account directly, you also need:
-
-| Item | Description                                                                                          |
-| ---- | ---------------------------------------------------------------------------------------------------- |
-| FQDN | The fully qualified domain name for connecting to your SAP Ariba instance. For example: s1.ariba.com |
-
-If you use Azure Active Directory as your identity provider, you also need:
-
-| Item             | Description                                        |
-| ---------------- | -------------------------------------------------- |
-| Azure 2FA secret | A key used to generate one-time passcodes for MFA. |
-
-***
-
-#### Step 1 — Identify the administrator account
-
-Identify the SAP Ariba account whose login credentials you will supply during onboarding.
-
-Required permissions: The account must have administrator permissions to the SAP Ariba realm you want SaaS Security to scan.
-
-***
-
-#### Step 2 — Choose a login method
-
-Determine whether you want SaaS Security to log in to the administrator account directly, or through Microsoft Azure AD.
-
-Using Microsoft Azure AD adds an extra layer of security by requiring MFA with one-time passcodes. If you use Azure AD, SaaS Security requires additional information for MFA.
-
-***
-
-#### Step 3 — (Azure AD login only) Configure MFA
-
-If you are using Microsoft Azure AD as your identity provider:
-
-1. [Enable third-party software OATH tokens](https://docs.paloaltonetworks.com/saas-security/sspm/onboard-saas-apps-supported-by-sspm/onboarding-an-app-using-azure-ad-credentials#onboarding-an-app-using-azure-ad-credentials_az_enable_mfa) for the administrator account.
-2. [Configure the account for MFA and copy the MFA secret key](https://docs.paloaltonetworks.com/saas-security/sspm/onboard-saas-apps-supported-by-sspm/onboarding-an-app-using-azure-ad-credentials#onboarding-an-app-using-azure-ad-credentials_az_copy_mfa).
-
-***
-
-#### Step 4 — Identify your realm name and FQDN
-
-1. Log in to your SAP Ariba realm using the administrator account you identified in Step 1. After login, the URL contains a realm query parameter showing your realm name.
-2. From the browser address bar, locate the realm parameter in the URL.
-3. Make note of the realm name. You will provide this value during onboarding.
-4. (Direct login only) Also make note of the fully qualified domain name shown in the browser address bar. During onboarding, you will select the FQDN from a list. Possible values include s1.ariba.com and s3.ariba.com.
-
-***
-
-#### Step 5 — Connect SaaS Security to SAP Ariba
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select Settings > Data Sources and Integrations > Add New and click the SAP Ariba tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, select how SaaS Security will connect:
-   1. Log in with Credentials — for direct login
-   2. Log in with Azure — for Azure AD login
-7. When prompted, provide the administrator credentials and your realm name.
-8. Direct login: Select the FQDN for your SAP Ariba instance.
-9. Azure AD login: Provide the Azure 2FA secret for MFA.
-10. Click **Next**.
-11. On the **Configurations** tab:
-    1. Set the Sync Interval.
-    2. (Optional) Add a Tag.
-12. Click **Next** to complete onboarding.

▸ Onboard Sentry deleted +0 −54

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-sentry

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,54 +0,0 @@

---

description: >-

Onboard Sentry to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Sentry

SaaS Security connects to the Sentry API using a personal access token that you generate from a Sentry account. After connecting, SaaS Security scans your Sentry instance for misconfigured settings and account risks.

Note: The supported Sentry account plan for SaaS Security scans is the Business Plan.

The onboarding process requires the following credential:

Item│Description

| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Personal Token│A personal access token generated from a Sentry account. This unique alphanumeric string gives SaaS Security read-only access to organization and member data for a Sentry organization.

#### Step 1 — Generate a personal access token

1. Identify the Sentry account you will use to generate the token.

Required permissions: No elevated permissions are required, but the account must be a member of the organization you want SaaS Security to scan.

2. Open a browser to the Sentry login page and log in to the account you identified.

3. On the Sentry dashboard, open the account drop-down menu in the upper-left corner and select Personal Tokens.

4. On the Personal Tokens page, click Create New Token.

5. Select the following permission scopes for the token:

• member:read

• org:read

6. Enter a name for the token — for example, SaaS-Security-Integration-Token — then click Create Token.

7. Copy the personal access token and save it to a text file.

Note: Do not proceed to the next step until you have copied the personal token. You must provide this token during the onboarding process.

#### Step 2 — Connect SaaS Security to Sentry

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the Sentry tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, select Log in with Credentials and enter your personal token.

7. Click Next.

8. On the Configurations tab:

1. Set the Sync Interval.

2. (Optional) Add a Tag.

9. Click Next to complete onboarding.

Show markdown source

@@ -1,54 +0,0 @@
----
-description: >-
-  Onboard Sentry to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Sentry
-
-SaaS Security connects to the Sentry API using a personal access token that you generate from a Sentry account. After connecting, SaaS Security scans your Sentry instance for misconfigured settings and account risks.
-
-**Note**: The supported Sentry account plan for SaaS Security scans is the Business Plan.
-
-The onboarding process requires the following credential:
-
-| Item           | Description                                                                                                                                                                              |
-| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Personal Token | A personal access token generated from a Sentry account. This unique alphanumeric string gives SaaS Security read-only access to organization and member data for a Sentry organization. |
-
-***
-
-#### Step 1 — Generate a personal access token
-
-1. Identify the Sentry account you will use to generate the token.
-
-Required permissions: No elevated permissions are required, but the account must be a member of the organization you want SaaS Security to scan.
-
-2. Open a browser to the [Sentry login page](https://sentry.io/auth/login/) and log in to the account you identified.
-3. On the Sentry dashboard, open the account drop-down menu in the upper-left corner and select Personal Tokens.
-4. On the Personal Tokens page, click Create New Token.
-5. Select the following permission scopes for the token:
-
-* member:read
-* org:read
-
-6. Enter a name for the token — for example, SaaS-Security-Integration-Token — then click Create Token.
-7. Copy the personal access token and save it to a text file.
-
-**Note**: Do not proceed to the next step until you have copied the personal token. You must provide this token during the onboarding process.
-
-***
-
-#### Step 2 — Connect SaaS Security to Sentry
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select **Settings > Data Sources and Integrations > Add New** and click the Sentry tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, select Log in with Credentials and enter your personal token.
-7. Click Next.
-8. On the Configurations tab:
-   1. Set the Sync Interval.
-   2. (Optional) Add a Tag.
-9. Click **Next** to complete onboarding.

▸ Onboard ServiceNow deleted +0 −120

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-servicenow

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,120 +0,0 @@

---

description: >-

Onboard ServiceNow to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard ServiceNow

SaaS Security connects to ServiceNow using OAuth 2.0 authorization. Before onboarding, you register an OAuth 2.0 application in ServiceNow. During onboarding, SaaS Security redirects you to ServiceNow to log in and grant access. After connecting, SaaS Security scans your ServiceNow instance for misconfigured settings, third-party plugins, and account risks.

You can also use the same OAuth 2.0 application to enable ServiceNow ticketing from SaaS Security. Onboarding for scans and linking for ticketing are separate procedures, but the OAuth 2.0 application can include redirect URLs for both.

The onboarding process requires the following credentials:

Item│Description

| ------------- | -------------------------------------------------------------------------------------------- |

Client ID│Generated by ServiceNow to uniquely identify your OAuth 2.0 application.

Client Secret│Generated by ServiceNow; used by SaaS Security to authenticate to the OAuth 2.0 application.

Instance URL│The unique URL for your ServiceNow instance.

#### Step 1 — Get the redirect URL from Cortex

Before registering your OAuth 2.0 application in ServiceNow, retrieve the redirect URL that SaaS Security requires.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the ServiceNow tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, select OAuth 2.0. SaaS Security displays the Redirect URL value on the configuration page.

7. Copy the redirect URL and save it to a text file.

Note: Do not complete the onboarding flow yet. You will return to this page after configuring ServiceNow.

#### Step 2 — Create an authentication scope in ServiceNow

By default, an OAuth token grants full access to all REST APIs the ServiceNow account can access. Create an authentication scope to limit SaaS Security access to the Table API only.

1. Log in to ServiceNow as an administrator.

2. Verify that the REST API Auth Scope plugin (com.glide.rest.auth.scope) is activated. Navigate to System Definition > Plugins and search for the plugin. If it is not installed, follow the ServiceNow documentation to activate it.

3. Create the authentication scope:

4. Navigate to the Authentication Scopes table (sys_auth_scope.list) using the filter navigator.

5. Click New.

6. Enter a Name for the scope — for example, SaaS-Security-Connector. Optionally add a Description.

Note: Record this name. You will need it when configuring the REST API Auth Scope and the OAuth 2.0 application.

7. Click Submit.

8. Create a REST API Auth Scope and link it to your authentication scope:

9. Navigate to System Web Services > API Auth Scopes > REST API Auth Scope.

10. Click New.

11. Enter a Name for the REST API Auth Scope.

12. From the REST API list, select Table API.

13. Configure the access level:

1. Read-only access (configuration scans, account scans, third-party plugin scans; no automated remediation): Deselect Apply auth scope to all http methods in this API, then set HTTP Method to GET.

2. Read and write access (scans plus automated remediation): Select Apply auth scope to all http methods in this API.

14. In the Auth Scope field, enter the name of the authentication scope you created.

15. Click Submit.

#### Step 3 — Create an OAuth 2.0 application in ServiceNow

1. Log in to ServiceNow as an administrator.

2. Navigate to System OAuth > Application Registry.

3. Click New and select Create an OAuth API endpoint for external clients.

4. Fill in the application details:

• Redirect URL — Enter the redirect URL you copied from Cortex. If you also want to enable ticketing, add the ticketing redirect URL separated by a comma.

• Auth Scopes — Add the authentication scope you created in Step 2.

• If the form includes an Enforce Token Restrictions checkbox, make sure it is not selected.

5. Click Submit. ServiceNow registers the application and displays it in the Application Registries list.

6. Open your OAuth 2.0 application and copy the Client ID and Client Secret to a text file.

Note: Do not proceed until you have copied both values. You must provide them during onboarding.

#### Step 4 — Verify ServiceNow table access

SaaS Security must be able to access the following ServiceNow tables via the REST Table API:

sys_plugins, sys_properties, sys_scope, sys_user, sys_user_has_role, sys_user_role, oauth_entity, oauth_credential, v_plugin, sys_db_object, pwd_reset_request

For each table:

1. Navigate to System Definition > Tables.

2. Locate the table record and click its name to open it.

3. Select the Application Access tab.

4. Verify that Allow access to this table via web services is selected. If not, select it and click Update.

#### Step 5 — Connect SaaS Security to ServiceNow

1. Return to the Cortex onboarding flow you started in Step 1 (or navigate to Settings > Data Sources and Integrations > Add New > ServiceNow tile).

2. On the Connections tab, select OAuth 2.0.

3. Enter your Instance URL, Client ID, and Client Secret.

4. Select the permission level:

• Read Permissions — if you configured the authentication scope for GET only.

• Read and Write Permissions — if you configured the authentication scope for all HTTP methods.

5. Click Connect. SaaS Security redirects you to the ServiceNow login page.

6. Log in using a ServiceNow administrator account assigned to the admin role.

Note: The account must not be assigned to the snc_read_only role — this restricts the account to read-only access and will cause onboarding to fail. After onboarding is complete, you can restrict the account to read-only access. Full access is required only during onboarding and reauthentication.

7. Review the consent form and click Allow to grant access.

8. On the Configurations tab:

• Set the Sync Interval.

• (Optional) Add a Tag.

9. Click Next to complete onboarding.

Show markdown source

@@ -1,120 +0,0 @@
----
-description: >-
-  Onboard ServiceNow to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard ServiceNow
-
-SaaS Security connects to ServiceNow using OAuth 2.0 authorization. Before onboarding, you register an OAuth 2.0 application in ServiceNow. During onboarding, SaaS Security redirects you to ServiceNow to log in and grant access. After connecting, SaaS Security scans your ServiceNow instance for misconfigured settings, third-party plugins, and account risks.
-
-You can also use the same OAuth 2.0 application to enable ServiceNow ticketing from SaaS Security. Onboarding for scans and linking for ticketing are separate procedures, but the OAuth 2.0 application can include redirect URLs for both.
-
-The onboarding process requires the following credentials:
-
-| Item          | Description                                                                                  |
-| ------------- | -------------------------------------------------------------------------------------------- |
-| Client ID     | Generated by ServiceNow to uniquely identify your OAuth 2.0 application.                     |
-| Client Secret | Generated by ServiceNow; used by SaaS Security to authenticate to the OAuth 2.0 application. |
-| Instance URL  | The unique URL for your ServiceNow instance.                                                 |
-
-***
-
-#### Step 1 — Get the redirect URL from Cortex
-
-Before registering your OAuth 2.0 application in ServiceNow, retrieve the redirect URL that SaaS Security requires.
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select **Settings > Data Sources and Integrations > Add New** and click the ServiceNow tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, select OAuth 2.0. SaaS Security displays the Redirect URL value on the configuration page.
-7. Copy the redirect URL and save it to a text file.
-
-**Note**: Do not complete the onboarding flow yet. You will return to this page after configuring ServiceNow.
-
-***
-
-#### Step 2 — Create an authentication scope in ServiceNow
-
-By default, an OAuth token grants full access to all REST APIs the ServiceNow account can access. Create an authentication scope to limit SaaS Security access to the Table API only.
-
-1. Log in to ServiceNow as an administrator.
-2. Verify that the REST API Auth Scope plugin (com.glide.rest.auth.scope) is activated. Navigate to System Definition > Plugins and search for the plugin. If it is not installed, follow the [ServiceNow documentation to activate it](https://www.servicenow.com/docs/bundle/xanadu-platform-security/page/administer/security/task/activate-rest-api-auth-scope.html).
-3. Create the authentication scope:
-4. Navigate to the Authentication Scopes table (sys\_auth\_scope.list) using the filter navigator.
-5. Click New.
-6. Enter a Name for the scope — for example, SaaS-Security-Connector. Optionally add a Description.
-
-**Note**: Record this name. You will need it when configuring the REST API Auth Scope and the OAuth 2.0 application.
-
-7. Click Submit.
-8. Create a REST API Auth Scope and link it to your authentication scope:
-9. Navigate to System Web Services > API Auth Scopes > REST API Auth Scope.
-10. Click New.
-11. Enter a Name for the REST API Auth Scope.
-12. From the REST API list, select Table API.
-13. Configure the access level:
-    1. Read-only access (configuration scans, account scans, third-party plugin scans; no automated remediation): Deselect Apply auth scope to all http methods in this API, then set HTTP Method to GET.
-    2. Read and write access (scans plus automated remediation): Select Apply auth scope to all http methods in this API.
-14. In the Auth Scope field, enter the name of the authentication scope you created.
-15. Click Submit.
-
-***
-
-#### Step 3 — Create an OAuth 2.0 application in ServiceNow
-
-1. Log in to ServiceNow as an administrator.
-2. Navigate to System OAuth > Application Registry.
-3. Click New and select Create an OAuth API endpoint for external clients.
-4. Fill in the application details:
-
-* Redirect URL — Enter the redirect URL you copied from Cortex. If you also want to enable ticketing, add the ticketing redirect URL separated by a comma.
-* Auth Scopes — Add the authentication scope you created in Step 2.
-* If the form includes an Enforce Token Restrictions checkbox, make sure it is not selected.
-
-5. Click Submit. ServiceNow registers the application and displays it in the Application Registries list.
-6. Open your OAuth 2.0 application and copy the Client ID and Client Secret to a text file.
-
-**Note**: Do not proceed until you have copied both values. You must provide them during onboarding.
-
-***
-
-#### Step 4 — Verify ServiceNow table access
-
-SaaS Security must be able to access the following ServiceNow tables via the REST Table API:
-
-sys\_plugins, sys\_properties, sys\_scope, sys\_user, sys\_user\_has\_role, sys\_user\_role, oauth\_entity, oauth\_credential, v\_plugin, sys\_db\_object, pwd\_reset\_request
-
-For each table:
-
-1. Navigate to System Definition > Tables.
-2. Locate the table record and click its name to open it.
-3. Select the Application Access tab.
-4. Verify that Allow access to this table via web services is selected. If not, select it and click Update.
-
-***
-
-#### Step 5 — Connect SaaS Security to ServiceNow
-
-1. Return to the Cortex onboarding flow you started in Step 1 (or navigate to Settings > Data Sources and Integrations > Add New > ServiceNow tile).
-2. On the Connections tab, select OAuth 2.0.
-3. Enter your Instance URL, Client ID, and Client Secret.
-4. Select the permission level:
-
-* Read Permissions — if you configured the authentication scope for GET only.
-* Read and Write Permissions — if you configured the authentication scope for all HTTP methods.
-
-5. Click Connect. SaaS Security redirects you to the ServiceNow login page.
-6. Log in using a ServiceNow administrator account assigned to the admin role.
-
-**Note**: The account must not be assigned to the snc\_read\_only role — this restricts the account to read-only access and will cause onboarding to fail. After onboarding is complete, you can restrict the account to read-only access. Full access is required only during onboarding and reauthentication.
-
-7. Review the consent form and click Allow to grant access.
-8. On the Configurations tab:
-
-* Set the Sync Interval.
-* (Optional) Add a Tag.
-
-9. Click Next to complete onboarding.

▸ Onboard Shopify deleted +0 −88

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-shopify

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,88 +0,0 @@

---

description: >-

Onboard Shopify to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Shopify

SaaS Security connects to the Shopify API using an API token generated from a custom Shopify app. Creating a custom app ensures the token is scoped to only the permissions SaaS Security requires. After connecting, SaaS Security scans your Shopify store for misconfigured settings and account risks.

Note: These steps onboard a single Shopify store. To scan multiple stores, onboard each store separately. The supported Shopify account plan for SaaS Security scans is the Shopify Plus plan.

The onboarding process requires the following credentials:

Item│Description

| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

API Token│A unique alphanumeric string that Shopify generates for a custom app you create. SaaS Security uses this token to authenticate to the Shopify API with the scopes specified in the custom app.

Store Name│The permanent subdomain identifier for your store, derived from the default URL Shopify assigned: <store-name>.myshopify.com.

#### Step 1 — Identify the Shopify account

Identify the Shopify account you will use to create the custom app.

Required permissions: The account must be assigned to the Organization Owner role to create a custom app and generate an API token.

#### Step 2 — Create a custom app and generate an API token

1. Open a browser to the Shopify admin login page and log in to the store you want SaaS Security to scan.

2. Click Settings in the lower-left corner to open store settings.

3. From the left navigation pane, select Apps and sales channels.

4. Click Develop apps.

5. Click Create app.

6. In the Create an app dialog, enter a name for the app and click Create app. Shopify displays a tabbed configuration page for the new app.

7. On the Configuration tab, configure the Admin API Integration scopes:

1. Click Configure under Admin API Integration.

2. Select the following scopes:

• read_apps

• read_privacy_settings

Note: The read_users scope is also required but is restricted by default and not available for selection here. You will request access to this scope from Shopify Plus Support in a later step.

8. Click Save.

9. On the API credentials tab, click Install app, then confirm by clicking Install in the dialog.

10. Contact Shopify Plus Support to request access to the read_users scope for your app:

1. In the upper-right corner of the page, locate your store's brand name (default: My Store) and select <brand-name> > Shopify Plus Support.

2. Click Chat with us and ask the support agent to enable the read_users scope for your application.

It can take a few minutes to an hour for Shopify Plus Support to enable the scope.

11. After Shopify Plus Support enables read_users, add the scope to your app:

1. On the Configuration tab, click Edit under Admin API Integration.

2. Select the read_users scope.

3. Click Save.

12. On the API credentials tab, click Reveal token once to display the API token.

13. Copy the API token and save it to a text file.

Note: Do not proceed until you have copied the API token. You must provide it during the onboarding process.

#### Step 3 — Identify your store name

Your store name is the subdomain of the default URL Shopify assigned when you created the store (<store-name>.myshopify.com).

1. Click Settings in the lower-left corner to open store settings.

2. In the left navigation pane, locate the default URL for your store. The store name is the value before .myshopify.com.

#### Step 4 — Connect SaaS Security to Shopify

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the Shopify tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, select Log in with Credentials.

7. Enter your API Token and Store Name.

8. Click Next.

9. On the Configurations tab:

1. Set the Sync Interval.

2. (Optional) Add a Tag.

10. Click Next to complete onboarding.

Show markdown source

@@ -1,88 +0,0 @@
----
-description: >-
-  Onboard Shopify to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Shopify
-
-SaaS Security connects to the Shopify API using an API token generated from a custom Shopify app. Creating a custom app ensures the token is scoped to only the permissions SaaS Security requires. After connecting, SaaS Security scans your Shopify store for misconfigured settings and account risks.
-
-**Note**: These steps onboard a single Shopify store. To scan multiple stores, onboard each store separately. The supported Shopify account plan for SaaS Security scans is the Shopify Plus plan.
-
-The onboarding process requires the following credentials:
-
-| Item       | Description                                                                                                                                                                                    |
-| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| API Token  | A unique alphanumeric string that Shopify generates for a custom app you create. SaaS Security uses this token to authenticate to the Shopify API with the scopes specified in the custom app. |
-| Store Name | The permanent subdomain identifier for your store, derived from the default URL Shopify assigned: \<store-name>.myshopify.com.                                                                 |
-
-***
-
-#### Step 1 — Identify the Shopify account
-
-Identify the Shopify account you will use to create the custom app.
-
-Required permissions: The account must be assigned to the Organization Owner role to create a custom app and generate an API token.
-
-***
-
-#### Step 2 — Create a custom app and generate an API token
-
-1. Open a browser to the [Shopify admin login page](https://admin.shopify.com/) and log in to the store you want SaaS Security to scan.
-2. Click Settings in the lower-left corner to open store settings.
-3. From the left navigation pane, select Apps and sales channels.
-4. Click Develop apps.
-5. Click Create app.
-6. In the Create an app dialog, enter a name for the app and click Create app. Shopify displays a tabbed configuration page for the new app.
-7. On the Configuration tab, configure the Admin API Integration scopes:
-   1. Click Configure under Admin API Integration.
-   2. Select the following scopes:
-
-* read\_apps
-* read\_privacy\_settings
-
-**Note**: The read\_users scope is also required but is restricted by default and not available for selection here. You will request access to this scope from Shopify Plus Support in a later step.
-
-8. Click Save.
-9. On the API credentials tab, click Install app, then confirm by clicking Install in the dialog.
-10. Contact Shopify Plus Support to request access to the read\_users scope for your app:
-    1. In the upper-right corner of the page, locate your store's brand name (default: My Store) and select \<brand-name> > Shopify Plus Support.
-    2. Click Chat with us and ask the support agent to enable the read\_users scope for your application.
-
-It can take a few minutes to an hour for Shopify Plus Support to enable the scope.
-
-11. After Shopify Plus Support enables read\_users, add the scope to your app:
-    1. On the Configuration tab, click Edit under Admin API Integration.
-    2. Select the read\_users scope.
-    3. Click Save.
-12. On the API credentials tab, click Reveal token once to display the API token.
-13. Copy the API token and save it to a text file.
-
-**Note**: Do not proceed until you have copied the API token. You must provide it during the onboarding process.
-
-***
-
-#### Step 3 — Identify your store name
-
-Your store name is the subdomain of the default URL Shopify assigned when you created the store (\<store-name>.myshopify.com).
-
-1. Click Settings in the lower-left corner to open store settings.
-2. In the left navigation pane, locate the default URL for your store. The store name is the value before .myshopify.com.
-
-***
-
-#### Step 4 — Connect SaaS Security to Shopify
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select **Settings > Data Sources and Integrations > Add New** and click the Shopify tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, select Log in with Credentials.
-7. Enter your API Token and Store Name.
-8. Click Next.
-9. On the Configurations tab:
-   1. Set the Sync Interval.
-   2. (Optional) Add a Tag.
-10. Click **Next** to complete onboarding.

▸ Onboard Slack Enterprise deleted +0 −69

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-slack-enterprise

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,69 +0,0 @@

---

description: >-

Onboard Slack Enterprise to Cortex XSIAM for SaaS security posture monitoring

and compliance visibility.

---

# Onboard Slack Enterprise

SaaS Security connects to the Slack Enterprise API using a User OAuth Token generated from a Slack org-wide app that you create. A Slack org-wide app is deployed across all workspaces in your organization.

Note: The Slack Enterprise connector was updated in May 2025 to support the Identity Security dashboard. If you onboarded your Slack Enterprise instance before this update and want to view account risks in the Identity Security dashboard, you must re-onboard your Slack instance. Before re-onboarding, add the admin.users:read OAuth scope to your existing org-wide app.

Onboarding consists of two tasks:

1. Create an org-wide app and generate a User OAuth Token

2. Connect SaaS Security to your Slack Enterprise instance

#### Task 1 — Create an App for Accessing Your Slack Enterprise Instance

Step 1 — Identify the administrator account

Identify the Slack administrator account you will use to create the org-wide app.

Required permissions: The account must be assigned to the Org Admin role or a role with greater permissions, because you will install the app across all workspaces in your organization.

Step 2 — Create the Slack app

1. Log in to the Slack API console and navigate to the Your Apps page at api.slack.com/apps.

2. Click Create New App.

3. In the Create an app dialog, select From scratch.

4. In the Name app & choose workspace dialog, enter a name for your app and select a workspace. You will configure the app in this workspace and later deploy it across your organization.

5. Click Create App. Slack Enterprise displays the configuration settings for your new app.

Step 3 — Configure the app scopes and opt in to org-wide deployment

1. Navigate to OAuth and Permissions settings and locate the Scopes section.

2. Under Bot Token Scopes, click Add an OAuth Scope and select team:read.

3. Navigate to Org Level Apps settings and click Opt in to the org apps program.

4. Navigate back to OAuth and Permissions settings and locate the Scopes section.

5. Under User Token Scopes, click Add an OAuth Scope and add the following scopes:

1. admin.teams:read

2. auditlogs:read

3. team:read

4. admin.users:read (required for identity scans)

Step 4 — Install the app and copy the User OAuth Token

1. In the OAuth and Permissions settings, locate the OAuth Tokens for Your Workspace section and click Install to Organization. Slack Enterprise generates tokens for your app.

2. Copy the User OAuth Token and save it to a text file.

Note: Do not proceed until you have copied the User OAuth Token. You must provide this token during onboarding when SaaS Security prompts you for an API Key.

#### Task 2 — Connect SaaS Security to Your Slack Enterprise Instance

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the Slack Enterprise tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, enter your User OAuth Token in the API Key field.

7. Click Next.

8. On the Configurations tab:

1. Set the Sync Interval.

2. (Optional) Add a Tag.

9. Click Next to complete onboarding.

Show markdown source

@@ -1,69 +0,0 @@
----
-description: >-
-  Onboard Slack Enterprise to Cortex XSIAM for SaaS security posture monitoring
-  and compliance visibility.
----
-
-# Onboard Slack Enterprise
-
-SaaS Security connects to the Slack Enterprise API using a User OAuth Token generated from a Slack org-wide app that you create. A Slack org-wide app is deployed across all workspaces in your organization.
-
-**Note**: The Slack Enterprise connector was updated in May 2025 to support the Identity Security dashboard. If you onboarded your Slack Enterprise instance before this update and want to view account risks in the Identity Security dashboard, you must re-onboard your Slack instance. Before re-onboarding, add the admin.users:read OAuth scope to your existing org-wide app.
-
-Onboarding consists of two tasks:
-
-1. Create an org-wide app and generate a User OAuth Token
-2. Connect SaaS Security to your Slack Enterprise instance
-
-***
-
-#### Task 1 — Create an App for Accessing Your Slack Enterprise Instance
-
-**Step 1 — Identify the administrator account**
-
-Identify the Slack administrator account you will use to create the org-wide app.
-
-Required permissions: The account must be assigned to the Org Admin role or a role with greater permissions, because you will install the app across all workspaces in your organization.
-
-**Step 2 — Create the Slack app**
-
-1. Log in to the Slack API console and navigate to the Your Apps page at [api.slack.com/apps](https://api.slack.com/apps).
-2. Click Create New App.
-3. In the Create an app dialog, select From scratch.
-4. In the Name app & choose workspace dialog, enter a name for your app and select a workspace. You will configure the app in this workspace and later deploy it across your organization.
-5. Click Create App. Slack Enterprise displays the configuration settings for your new app.
-
-**Step 3 — Configure the app scopes and opt in to org-wide deployment**
-
-1. Navigate to OAuth and Permissions settings and locate the Scopes section.
-2. Under Bot Token Scopes, click Add an OAuth Scope and select team:read.
-3. Navigate to Org Level Apps settings and click Opt in to the org apps program.
-4. Navigate back to OAuth and Permissions settings and locate the Scopes section.
-5. Under User Token Scopes, click Add an OAuth Scope and add the following scopes:
-   1. admin.teams:read
-   2. auditlogs:read
-   3. team:read
-   4. admin.users:read (required for identity scans)
-
-**Step 4 — Install the app and copy the User OAuth Token**
-
-1. In the OAuth and Permissions settings, locate the OAuth Tokens for Your Workspace section and click Install to Organization. Slack Enterprise generates tokens for your app.
-2. Copy the User OAuth Token and save it to a text file.
-
-**Note**: Do not proceed until you have copied the User OAuth Token. You must provide this token during onboarding when SaaS Security prompts you for an API Key.
-
-***
-
-#### Task 2 — Connect SaaS Security to Your Slack Enterprise Instance
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select **Settings > Data Sources and Integrations > Add New** and click the Slack Enterprise tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, enter your User OAuth Token in the API Key field.
-7. Click Next.
-8. On the **Configurations** tab:
-   1. Set the **Sync Interval**.
-   2. (Optional) Add a Tag.
-9. Click **Next** to complete onboarding.

▸ Onboard Sumo Logic deleted +0 −86

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-sumo-logic

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,86 +0,0 @@

---

description: >-

Onboard Sumo Logic to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Sumo Logic

SaaS Security connects to the Sumo Logic API using an access key that you generate as the Sumo Logic account owner. After connecting, SaaS Security Checks scans your Sumo Logic instance for misconfigured settings and account risks.

Note: The supported Sumo Logic account plan for SaaS Security scans is the Enterprise plan.

The onboarding process requires the following credentials:

Item│Description

| ---------------- | ------------------------------------------------------------------------------------------------------- |

Admin Access ID│A unique alphanumeric string that identifies the access key pair — analogous to a user ID.

Admin Access Key│The secret credential SaaS Security Checks uses to authenticate API requests — analogous to a password.

Endpoint Region│The region where Sumo Logic hosts your data.

#### Step 1 — Generate a Sumo Logic access key

1. Identify the Sumo Logic account you will use to generate the access key.

Required permissions: You must generate the access key from the account designated as the Sumo Logic account owner — either the user who registered the account or a user later designated as owner.

2. Log in to Sumo Logic as the account owner.

3. Navigate to your preferences: click your profile icon in the upper-right corner and select <profile-icon> > Preferences.

4. Select the Personal Access Keys tab and click Add Access Key.

5. In the Add New Access Key window, enter a meaningful name for the key — for example, SaaS-Security-Integration.

6. Under Scopes, select the Custom option and select the following scopes:

Note: Because the access key is generated from the account owner (highest privilege level), explicitly limit the key's permissions to the minimum required by SaaS Security Checks.

• Access Keys - View

• Access Keys - Manage

• Users And Roles - View

• Users And Roles - Manage

• Content admin

• Manage Library

• Run Log Search - View/Manage

• View Collectors

• View Security Settings

• View Account Status

7. Click Save. Sumo Logic generates the key and displays the Access ID and Access Key.

8. Copy the Access ID and Access Key and save them to a text file.

Note: Do not proceed until you have copied both values. You must provide them during onboarding.

#### Step 2 — Identify your endpoint region

Use the following table to determine your region based on your Sumo Logic login URL:

URL│Region

| ------------------------- | ------------------- |

api.au.sumologic.com│AU (Australia)

api.ca.sumologic.com│CA (Canada)

service.de.sumologic.com│DE (Germany)

service.eu.sumologic.com│EU (European Union)

service.fed.sumologic.com│FED (US Government)

service.in.sumologic.com│IN (India)

service.jp.sumologic.com│JP (Japan)

service.sumologic.com│US1 (United States)

service.us2.sumologic.com│US2 (United States)

#### Step 3 — Connect SaaS Security Checks to Sumo Logic

1. Log in to Cortex.

2. Select Modules > SaaS Security > Add Data Source and click the Sumo Logic tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, select Log in with Credentials.

7. Enter your Admin Access ID, Admin Access Key, and Endpoint Region.

8. Click Next.

9. On the Configurations tab:

1. Set the Sync Interval.

2. (Optional) Add a Tag.

10. Click Next to complete onboarding.

Show markdown source

@@ -1,86 +0,0 @@
----
-description: >-
-  Onboard Sumo Logic to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Sumo Logic
-
-SaaS Security connects to the Sumo Logic API using an access key that you generate as the Sumo Logic account owner. After connecting, SaaS Security Checks scans your Sumo Logic instance for misconfigured settings and account risks.
-
-Note: The supported Sumo Logic account plan for SaaS Security scans is the Enterprise plan.
-
-The onboarding process requires the following credentials:
-
-| Item             | Description                                                                                             |
-| ---------------- | ------------------------------------------------------------------------------------------------------- |
-| Admin Access ID  | A unique alphanumeric string that identifies the access key pair — analogous to a user ID.              |
-| Admin Access Key | The secret credential SaaS Security Checks uses to authenticate API requests — analogous to a password. |
-| Endpoint Region  | The region where Sumo Logic hosts your data.                                                            |
-
-***
-
-#### Step 1 — Generate a Sumo Logic access key
-
-1. Identify the Sumo Logic account you will use to generate the access key.
-
-Required permissions: You must generate the access key from the account designated as the Sumo Logic account owner — either the user who registered the account or a user later designated as owner.
-
-2. Log in to Sumo Logic as the account owner.
-3. Navigate to your preferences: click your profile icon in the upper-right corner and select \<profile-icon> > Preferences.
-4. Select the Personal Access Keys tab and click Add Access Key.
-5. In the Add New Access Key window, enter a meaningful name for the key — for example, SaaS-Security-Integration.
-6. Under Scopes, select the Custom option and select the following scopes:
-
-**Note**: Because the access key is generated from the account owner (highest privilege level), explicitly limit the key's permissions to the minimum required by SaaS Security Checks.
-
-* Access Keys - View
-* Access Keys - Manage
-* Users And Roles - View
-* Users And Roles - Manage
-* Content admin
-* Manage Library
-* Run Log Search - View/Manage
-* View Collectors
-* View Security Settings
-* View Account Status
-
-7. Click Save. Sumo Logic generates the key and displays the Access ID and Access Key.
-8. Copy the Access ID and Access Key and save them to a text file.
-
-**Note**: Do not proceed until you have copied both values. You must provide them during onboarding.
-
-***
-
-#### Step 2 — Identify your endpoint region
-
-Use the following table to determine your region based on your Sumo Logic login URL:
-
-| URL                       | Region              |
-| ------------------------- | ------------------- |
-| api.au.sumologic.com      | AU (Australia)      |
-| api.ca.sumologic.com      | CA (Canada)         |
-| service.de.sumologic.com  | DE (Germany)        |
-| service.eu.sumologic.com  | EU (European Union) |
-| service.fed.sumologic.com | FED (US Government) |
-| service.in.sumologic.com  | IN (India)          |
-| service.jp.sumologic.com  | JP (Japan)          |
-| service.sumologic.com     | US1 (United States) |
-| service.us2.sumologic.com | US2 (United States) |
-
-***
-
-#### Step 3 — Connect SaaS Security Checks to Sumo Logic
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select **Modules > SaaS Security > Add Data Source** and click the Sumo Logic tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, select Log in with Credentials.
-7. Enter your Admin Access ID, Admin Access Key, and Endpoint Region.
-8. Click Next.
-9. On the **Configurations** tab:
-   1. Set the **Sync Interval**.
-   2. (Optional) Add a **Tag**.
-10. Click **Next** to complete onboarding.

▸ Onboard Workday deleted +0 −213

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-workday

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,213 +0,0 @@

---

description: >-

Onboard Workday to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Workday

SaaS Security connects to Workday using OAuth 2.0 authorization via an API Client for Integrations. To enable secure background scanning, you create a non-human integration system user account and associate it with the API client. SaaS Security also pulls data from a custom report that you expose as a web service.

Onboarding consists of four tasks:

1. Create an Integration System User

2. Register an API Client for Integrations

3. Create a Custom Report

4. Connect SaaS Security to Workday

The onboarding process requires the following credentials:

Item│Description

| --------------------------------------- | --------------------------------------------------------------------------------------------------------------- |

Client ID│Generated by Workday to uniquely identify the API Client for Integrations you create.

Client Secret│Generated by Workday; used by SaaS Security to authenticate to the API client.

Token Endpoint│Used by SaaS Security to generate an authentication token.

Refresh Token│A persistent token that maintains a secure connection independently of user sessions.

Custom Audit Log Report Web Service URL│The JSON web service URL for the custom report that SaaS Security uses to pull data from your Workday instance.

#### Task 1 — Create an Integration System User

Create a non-human integration system user account to allow SaaS Security to scan Workday independently of human user sessions.

Step 1 — Identify the administrator account

Required permissions: You must have Security Administrator permissions in Workday to create the integration system user.

Step 2 — Create the integration system user

1. Log in to the Workday console using the Security Administrator account.

2. In the search field, search for Create Integration System User and select it from the results.

3. On the Create Integration System User page, specify a username and password.

4. Select the Do Not Allow UI Sessions checkbox for enhanced security.

5. Click OK.

Step 3 — Create a security group for the integration system user

1. Search for Create Security Group and select it from the results.

2. On the Create Security Group page:

3. From the Type of Tenanted Security Group drop-down, select Integration System Security Group (Unconstrained).

4. Enter a name for the security group and click OK.

5. On the Integration System Security Group (Unconstrained) page:

6. In the Integration System Users field, select the integration system user you created.

7. Click OK.

Step 4 — Assign domain security policy permissions

1. Search for Maintain Permissions for Security Group and select it from the results.

2. On the Maintain Permissions for Security Group page:

3. Set Operation to Maintain.

4. Set Source Security Group to the security group you created.

5. Click OK.

6. On the second Maintain Permissions for Security Group page:

7. Select the Domain Security Policy Permissions tab.

8. Add the following domain security policies with View Only access:

Domain Security Policy│Access

| ---------------------------------- | --------- |

Workday Accounts│View Only

Worker Data: Public Worker Reports│View Only

Security Administration│View Only

Security Configuration│View Only

System Auditing│View Only

Step 5 — Activate pending security policy changes

1. Search for Activate Pending Security Policy Changes and select it from the results.

2. Enter a comment describing the changes and click OK.

3. On the confirmation page, select the Confirm checkbox and click OK.

#### Task 2 — Register an API Client for Integrations

Required permissions: You must have Security Administrator permissions in Workday.

1. Log in to the Workday console using the Security Administrator account.

2. Search for Register API Client for Integrations and select it from the results.

3. On the Register API Client for Integrations page, complete the following fields:

Field│Value

| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |

Client Name│A unique name — for example, SaaS_Security_Integration_Client.

Refresh Token Timeout (in days)│The number of days the refresh token is valid — for example, 365. Do not select Non-Expiring Refresh Tokens.

Scope (Functional Areas)│Select Tenant Non-Configurable and System. Verify that Workday Query Language appears under the Includes Domains column for the System functional area.

Include Workday Owned Scope│Select this checkbox.

4. Click OK. Workday registers the API client and displays the Client ID and Client Secret.

5. Copy the Client ID and Client Secret and save them to a text file.

Note: Do not proceed until you have copied both values. You must provide them during onboarding.

6. Generate a Refresh Token for the integration system user:

1. On the Edit API Client for Integrations page, click the ellipsis (...) next to the client name.

2. Select API Client > Manage Refresh Tokens for Integrations.

3. In the Workday Account field, select the integration system user you created and click OK.

4. On the Delete or Regenerate Refresh Token page, select Generate New Refresh Token and Confirm Delete.

5. Click OK.

6. Copy the Refresh Token and save it to a text file.

Note: Do not proceed until you have copied the Refresh Token.

7. Get the Token Endpoint:

1. Search for View API Clients and select it from the results.

2. On the View API Clients page, copy the Token Endpoint value and save it to a text file.

Note: Do not proceed until you have copied the Token Endpoint.

#### Task 3 — Create a Custom Report

SaaS Security pulls data from a custom report exposed as a web service. Complete the following steps using the Workday Security Administrator account.

1. Search for Create Custom Report and select it from the results.

2. On the Create Custom Report page:

1. Enter a Report Name.

2. Select Advanced from the Report Type list.

3. Select the Enable As Web Service and Optimized for Performance checkboxes.

4. Set Data Source to Processed Transactions for Range, System Account, Task and Business Object.

5. Click OK.

3. On the Edit Custom Report page, select the Columns tab and add the following columns:

Business Object│Field│Column Heading Override XML Alias

| ----------------------- | --------------------- | --------------------------------- |

Processed Transaction│Classes Updated│Classes_Updated

Processed Transaction│Instances Updated│Instances_Updated

Processed Transaction│Secured Task Executed│Task_Behavior

Processed Transaction│Entry Moment│Entry_Moment

Processed Transaction│Secured Task Executed│Secured_Task_Executed

Processed Transaction│Processed Transaction│Processed_Transaction

Processed Transaction│System Account│System_Account

Attributes that Changed│Changed Attribute│Changed_Attribute

Attributes that Changed│Previous Value│Previous_Value

Attributes that Changed│Value│Value

4. Under Group Column Headings, add the Attributes that Changed business object.

5. Select the Filters tab and add filters for the Task Behavior field. Add an Or condition for each of the following values (operator: exact match with the selection list, type: Value specified in this filter):

• Edit Tenant Setup - HCM

• Edit Tenant Setup - Global

• Edit Tenant Setup - Security

• Edit Tenant Setup - System

• Edit Tenant Setup - Reporting and Analytics

• Edit Tenant Setup - Recruiting

• Edit Tenant Setup - Payroll

• Edit Tenant Setup - Integrations

6. Select the Prompts tab:

• Select the Display Prompt Values in Subtitle checkbox.

• Add the following prompts (mark From Moment and To Moment as Required):

Field│Label For Prompt XML Alias│Required

| --------------- | -------------------------- | ----------- |

From Moment│From_Moment│Yes

To Moment│To_Moment│Yes

Business Object│Business_Object│

Task│Task│

Workday Account│Workday_Account│

Note: If the Business Object and Workday Account fields are not available, select Populate Undefined Prompt Defaults to add them.

7. Select the Share tab and configure the following sharing options:

Field│Value

| --------------------------------- | -------------------------------------------------------------- |

Report Definition Sharing Options│Share with specific authorized groups and users

Authorized Groups│The security group you created for the integration system user

Authorized Users│The integration system user you created

8. On the Sort tab, do not add or modify any fields. The Sort tab must remain in its default state.

9. Click OK to save the report.

10. Get the web service URL:

1. In the banner of the Create Custom Report page, click the ellipsis (...) next to the report name and select Web Service > View URLs.

2. On the View URLs Web Service page, locate the JSON section.

3. Copy the JSON URL and save it to a text file.

Note: Do not proceed until you have copied the JSON web service URL.

#### Task 4 — Connect SaaS Security to Workday

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the Workday tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, select Log in with Credentials.

7. Enter the following values:

• Client ID

• Client Secret

• Token Endpoint

• Refresh Token

• Custom Audit Log Report Web Service URL (JSON format)

8. Click Next.

9. On the Configurations tab:

1. Set the Sync Interval.

2. (Optional) Add a Tag.

10. Click Next to complete onboarding.

Show markdown source

@@ -1,213 +0,0 @@
----
-description: >-
-  Onboard Workday to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Workday
-
-SaaS Security connects to Workday using OAuth 2.0 authorization via an API Client for Integrations. To enable secure background scanning, you create a non-human integration system user account and associate it with the API client. SaaS Security also pulls data from a custom report that you expose as a web service.
-
-Onboarding consists of four tasks:
-
-1. Create an Integration System User
-2. Register an API Client for Integrations
-3. Create a Custom Report
-4. Connect SaaS Security to Workday
-
-The onboarding process requires the following credentials:
-
-| Item                                    | Description                                                                                                     |
-| --------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
-| Client ID                               | Generated by Workday to uniquely identify the API Client for Integrations you create.                           |
-| Client Secret                           | Generated by Workday; used by SaaS Security to authenticate to the API client.                                  |
-| Token Endpoint                          | Used by SaaS Security to generate an authentication token.                                                      |
-| Refresh Token                           | A persistent token that maintains a secure connection independently of user sessions.                           |
-| Custom Audit Log Report Web Service URL | The JSON web service URL for the custom report that SaaS Security uses to pull data from your Workday instance. |
-
-***
-
-#### Task 1 — Create an Integration System User
-
-Create a non-human integration system user account to allow SaaS Security to scan Workday independently of human user sessions.
-
-**Step 1 — Identify the administrator account**
-
-Required permissions: You must have Security Administrator permissions in Workday to create the integration system user.
-
-**Step 2 — Create the integration system user**
-
-1. Log in to the Workday console using the Security Administrator account.
-2. In the search field, search for Create Integration System User and select it from the results.
-3. On the Create Integration System User page, specify a username and password.
-4. Select the Do Not Allow UI Sessions checkbox for enhanced security.
-5. Click OK.
-
-**Step 3 — Create a security group for the integration system user**
-
-1. Search for Create Security Group and select it from the results.
-2. On the Create Security Group page:
-3. From the Type of Tenanted Security Group drop-down, select Integration System Security Group (Unconstrained).
-4. Enter a name for the security group and click OK.
-5. On the Integration System Security Group (Unconstrained) page:
-6. In the Integration System Users field, select the integration system user you created.
-7. Click OK.
-
-**Step 4 — Assign domain security policy permissions**
-
-1. Search for Maintain Permissions for Security Group and select it from the results.
-2. On the Maintain Permissions for Security Group page:
-3. Set Operation to Maintain.
-4. Set Source Security Group to the security group you created.
-5. Click OK.
-6. On the second Maintain Permissions for Security Group page:
-7. Select the Domain Security Policy Permissions tab.
-8. Add the following domain security policies with View Only access:
-
-| Domain Security Policy             | Access    |
-| ---------------------------------- | --------- |
-| Workday Accounts                   | View Only |
-| Worker Data: Public Worker Reports | View Only |
-| Security Administration            | View Only |
-| Security Configuration             | View Only |
-| System Auditing                    | View Only |
-
-**Step 5 — Activate pending security policy changes**
-
-1. Search for Activate Pending Security Policy Changes and select it from the results.
-2. Enter a comment describing the changes and click OK.
-3. On the confirmation page, select the Confirm checkbox and click OK.
-
-***
-
-#### Task 2 — Register an API Client for Integrations
-
-Required permissions: You must have Security Administrator permissions in Workday.
-
-1. Log in to the Workday console using the Security Administrator account.
-2. Search for Register API Client for Integrations and select it from the results.
-3. On the Register API Client for Integrations page, complete the following fields:
-
-| Field                           | Value                                                                                                                                                   |
-| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Client Name                     | A unique name — for example, SaaS\_Security\_Integration\_Client.                                                                                       |
-| Refresh Token Timeout (in days) | The number of days the refresh token is valid — for example, 365. Do not select Non-Expiring Refresh Tokens.                                            |
-| Scope (Functional Areas)        | Select Tenant Non-Configurable and System. Verify that Workday Query Language appears under the Includes Domains column for the System functional area. |
-| Include Workday Owned Scope     | Select this checkbox.                                                                                                                                   |
-
-4. Click OK. Workday registers the API client and displays the Client ID and Client Secret.
-5. Copy the Client ID and Client Secret and save them to a text file.
-
-**Note**: Do not proceed until you have copied both values. You must provide them during onboarding.
-
-6. Generate a Refresh Token for the integration system user:
-   1. On the Edit API Client for Integrations page, click the ellipsis (...) next to the client name.
-   2. Select API Client > Manage Refresh Tokens for Integrations.
-   3. In the Workday Account field, select the integration system user you created and click OK.
-   4. On the Delete or Regenerate Refresh Token page, select Generate New Refresh Token and Confirm Delete.
-   5. Click OK.
-   6. Copy the Refresh Token and save it to a text file.
-
-**Note**: Do not proceed until you have copied the Refresh Token.
-
-7. Get the Token Endpoint:
-   1. Search for View API Clients and select it from the results.
-   2. On the View API Clients page, copy the Token Endpoint value and save it to a text file.
-
-**Note**: Do not proceed until you have copied the Token Endpoint.
-
-***
-
-#### Task 3 — Create a Custom Report
-
-SaaS Security pulls data from a custom report exposed as a web service. Complete the following steps using the Workday Security Administrator account.
-
-1. Search for Create Custom Report and select it from the results.
-2. On the Create Custom Report page:
-   1. Enter a Report Name.
-   2. Select Advanced from the Report Type list.
-   3. Select the Enable As Web Service and Optimized for Performance checkboxes.
-   4. Set Data Source to Processed Transactions for Range, System Account, Task and Business Object.
-   5. Click OK.
-3. On the Edit Custom Report page, select the Columns tab and add the following columns:
-
-| Business Object         | Field                 | Column Heading Override XML Alias |
-| ----------------------- | --------------------- | --------------------------------- |
-| Processed Transaction   | Classes Updated       | Classes\_Updated                  |
-| Processed Transaction   | Instances Updated     | Instances\_Updated                |
-| Processed Transaction   | Secured Task Executed | Task\_Behavior                    |
-| Processed Transaction   | Entry Moment          | Entry\_Moment                     |
-| Processed Transaction   | Secured Task Executed | Secured\_Task\_Executed           |
-| Processed Transaction   | Processed Transaction | Processed\_Transaction            |
-| Processed Transaction   | System Account        | System\_Account                   |
-| Attributes that Changed | Changed Attribute     | Changed\_Attribute                |
-| Attributes that Changed | Previous Value        | Previous\_Value                   |
-| Attributes that Changed | Value                 | Value                             |
-
-4. Under Group Column Headings, add the Attributes that Changed business object.
-5. Select the Filters tab and add filters for the Task Behavior field. Add an Or condition for each of the following values (operator: exact match with the selection list, type: Value specified in this filter):
-
-* Edit Tenant Setup - HCM
-* Edit Tenant Setup - Global
-* Edit Tenant Setup - Security
-* Edit Tenant Setup - System
-* Edit Tenant Setup - Reporting and Analytics
-* Edit Tenant Setup - Recruiting
-* Edit Tenant Setup - Payroll
-* Edit Tenant Setup - Integrations
-
-6. Select the Prompts tab:
-
-* Select the Display Prompt Values in Subtitle checkbox.
-* Add the following prompts (mark From Moment and To Moment as Required):
-
-| Field           | Label For Prompt XML Alias | Required    |
-| --------------- | -------------------------- | ----------- |
-| From Moment     | From\_Moment               | Yes         |
-| To Moment       | To\_Moment                 | Yes         |
-| Business Object | Business\_Object           | <p><br></p> |
-| Task            | Task                       | <p><br></p> |
-| Workday Account | Workday\_Account           | <p><br></p> |
-
-**Note**: If the Business Object and Workday Account fields are not available, select Populate Undefined Prompt Defaults to add them.
-
-7. Select the Share tab and configure the following sharing options:
-
-| Field                             | Value                                                          |
-| --------------------------------- | -------------------------------------------------------------- |
-| Report Definition Sharing Options | Share with specific authorized groups and users                |
-| Authorized Groups                 | The security group you created for the integration system user |
-| Authorized Users                  | The integration system user you created                        |
-
-8. On the Sort tab, do not add or modify any fields. The Sort tab must remain in its default state.
-9. Click OK to save the report.
-10. Get the web service URL:
-    1. In the banner of the Create Custom Report page, click the ellipsis (...) next to the report name and select Web Service > View URLs.
-    2. On the View URLs Web Service page, locate the JSON section.
-    3. Copy the JSON URL and save it to a text file.
-
-Note: Do not proceed until you have copied the JSON web service URL.
-
-***
-
-#### Task 4 — Connect SaaS Security to Workday
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select **Settings > Data Sources and Integrations > Add New** and click the Workday tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, select Log in with Credentials.
-7. Enter the following values:
-
-* Client ID
-* Client Secret
-* Token Endpoint
-* Refresh Token
-* Custom Audit Log Report Web Service URL (JSON format)
-
-8. Click Next.
-9. On the Configurations tab:
-   1. Set the Sync Interval.
-   2. (Optional) Add a Tag.
-10. Click Next to complete onboarding.

▸ Onboard Wrike deleted +0 −77

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-wrike

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,77 +0,0 @@

---

description: >-

Onboard Wrike to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard Wrike

SaaS Security connects to Wrike using OAuth 2.0 authorization. Before onboarding, you create an OAuth 2.0 integration app in Wrike. During onboarding, SaaS Security redirects you to Wrike to log in and grant access.

Onboarding consists of two tasks:

1. Collect credentials for accessing your Wrike instance

2. Connect SaaS Security to Wrike

The onboarding process requires the following credentials:

Item│Description

| ------------- | ----------------------------------------------------------------------------------------------------- |

Client ID│Generated by Wrike to uniquely identify the OAuth 2.0 integration app you create.

Client Secret│Generated by Wrike; used by SaaS Security to authenticate to the integration app.

Email ID│The login email address of the Wrike Account Administrator who created the OAuth 2.0 integration app.

#### Task 1 — Collect Information for Accessing Your Wrike Instance

Step 1 — Get the redirect URL from Cortex

Before creating your OAuth 2.0 integration app in Wrike, retrieve the redirect URL that SaaS Security requires.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the Wrike tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, the Redirect URL value is displayed.

7. Copy the redirect URL and save it to a text file.

Note: Do not complete the onboarding flow yet. Return to the Add Data Source page and proceed to create the OAuth app in Wrike.

Step 2 — Identify the Wrike administrator account

Identify the Wrike administrator account you will use to create the OAuth 2.0 integration.

Required permissions: The OAuth 2.0 integration must be created by an Account Administrator.

Step 3 — Create the OAuth 2.0 integration app in Wrike

1. Open a browser and go to login.wrike.com and log in as the Account Administrator.

2. Navigate to the API Apps page:

• Click your profile icon in the upper-right corner and select Profile > Apps & Integrations.

• Select the API tab.

3. Enter an app name and click Create new. Wrike displays a configuration page for your new app, including the Client ID and Client Secret.

4. (Optional) Enter a description for the app.

5. Copy the Client ID and Client Secret and save them to a text file.

Note: Do not proceed until you have copied both values. You must provide them during onboarding.

6. Click Add Redirect URI and enter the redirect URL you copied from Cortex.

7. Click Save.

#### Task 2 — Connect SaaS Security to Wrike

1. Return to the Cortex onboarding flow (or navigate to Settings > Data Sources and Integrations > Add New > Wrike tile).

2. On the Connections tab, enter your Client ID, Client Secret, and Email ID.

3. Click Next. SaaS Security redirects you to the Wrike login page.

4. Log in to the Wrike administrator account. Wrike displays a consent form listing the access permissions SaaS Security requires.

5. Review the consent form and click Allow to grant the requested permissions.

6. On the Configurations tab:

1. Set the Sync Interval.

2. (Optional) Add a Tag.

7. Click Next to complete onboarding.

Show markdown source

@@ -1,77 +0,0 @@
----
-description: >-
-  Onboard Wrike to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard Wrike
-
-SaaS Security connects to Wrike using OAuth 2.0 authorization. Before onboarding, you create an OAuth 2.0 integration app in Wrike. During onboarding, SaaS Security redirects you to Wrike to log in and grant access.
-
-Onboarding consists of two tasks:
-
-1. Collect credentials for accessing your Wrike instance
-2. Connect SaaS Security to Wrike
-
-The onboarding process requires the following credentials:
-
-| Item          | Description                                                                                           |
-| ------------- | ----------------------------------------------------------------------------------------------------- |
-| Client ID     | Generated by Wrike to uniquely identify the OAuth 2.0 integration app you create.                     |
-| Client Secret | Generated by Wrike; used by SaaS Security to authenticate to the integration app.                     |
-| Email ID      | The login email address of the Wrike Account Administrator who created the OAuth 2.0 integration app. |
-
-***
-
-#### Task 1 — Collect Information for Accessing Your Wrike Instance
-
-**Step 1 — Get the redirect URL from Cortex**
-
-Before creating your OAuth 2.0 integration app in Wrike, retrieve the redirect URL that SaaS Security requires.
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select **Settings > Data Sources and Integrations > Add New** and click the Wrike tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, the Redirect URL value is displayed.
-7. Copy the redirect URL and save it to a text file.
-
-**Note**: Do not complete the onboarding flow yet. Return to the Add Data Source page and proceed to create the OAuth app in Wrike.
-
-**Step 2 — Identify the Wrike administrator account**
-
-Identify the Wrike administrator account you will use to create the OAuth 2.0 integration.
-
-Required permissions: The OAuth 2.0 integration must be created by an Account Administrator.
-
-**Step 3 — Create the OAuth 2.0 integration app in Wrike**
-
-1. Open a browser and go to [login.wrike.com](https://login.wrike.com) and log in as the Account Administrator.
-2. Navigate to the API Apps page:
-
-* Click your profile icon in the upper-right corner and select Profile > Apps & Integrations.
-* Select the API tab.
-
-3. Enter an app name and click Create new. Wrike displays a configuration page for your new app, including the Client ID and Client Secret.
-4. (Optional) Enter a description for the app.
-5. Copy the Client ID and Client Secret and save them to a text file.
-
-**Note**: Do not proceed until you have copied both values. You must provide them during onboarding.
-
-6. Click Add Redirect URI and enter the redirect URL you copied from Cortex.
-7. Click Save.
-
-***
-
-#### Task 2 — Connect SaaS Security to Wrike
-
-1. Return to the Cortex onboarding flow (or navigate to **Settings > Data Sources and Integrations > Add New > Wrike tile**).
-2. On the **Connections** tab, enter your Client ID, Client Secret, and Email ID.
-3. Click Next. SaaS Security redirects you to the Wrike login page.
-4. Log in to the Wrike administrator account. Wrike displays a consent form listing the access permissions SaaS Security requires.
-5. Review the consent form and click Allow to grant the requested permissions.
-6. On the Configurations tab:
-   1. Set the Sync Interval.
-   2. (Optional) Add a Tag.
-7. Click Next to complete onboarding.

▸ Onboard YouTrack deleted +0 −65

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-youtrack

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,65 +0,0 @@

---

description: >-

Onboard YouTrack to Cortex XSIAM for SaaS security posture monitoring and

compliance visibility.

---

# Onboard YouTrack

SaaS Security connects to the YouTrack API using a permanent token that you generate from a YouTrack administrator account. After connecting, SaaS Security scans your YouTrack instance for misconfigured settings.

Onboarding consists of two tasks:

1. Collect the instance name and generate a permanent token

2. Connect SaaS Security to YouTrack

The onboarding process requires the following credentials:

Item│Description

| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |

Instance Name│The unique subdomain that identifies your organization's YouTrack instance, as shown in your YouTrack URL: <instance-name>.youtrack.cloud.

Permanent Token│A token generated from a YouTrack administrator account assigned to the System Admin role. The token must be scoped to YouTrack and YouTrack Administration.

#### Task 1 — Collect Information for Accessing Your YouTrack Instance

Step 1 — Identify your YouTrack instance name

Open a browser and go to your YouTrack login page. Your instance name is the subdomain shown in the URL: <instance-name>.youtrack.cloud.

Note: Record your instance name before proceeding. You must provide it during onboarding.

Step 2 — Generate a permanent token

1. Log in to YouTrack as an administrator assigned to the System Admin role.

2. Click your account avatar in the upper-right corner and select <your-avatar> > Profile.

3. On your profile page, go to Account Security.

4. In the Tokens section, click New token.

5. In the New Permanent Token dialog:

• Enter a name for the token.

• Select the following scopes:

• YouTrack

• YouTrack Administration

6. Click Create. YouTrack displays the new permanent token.

7. Click Copy token and save it to a text file.

Note: Do not proceed until you have copied the token. You must provide it during onboarding.

#### Task 2 — Connect SaaS Security to YouTrack

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New and click the YouTrack tile.

3. On the Capabilities tab, enter a name for this instance.

4. Under Default Capabilities, confirm Security Posture is selected.

5. Click Next.

6. On the Connections tab, enter your Instance Name and Permanent Token.

7. Click Next.

8. On the Configurations tab:

1. Set the Sync Interval.

2. (Optional) Add a Tag.

9. Click Next to complete onboarding.

Show markdown source

@@ -1,65 +0,0 @@
----
-description: >-
-  Onboard YouTrack to Cortex XSIAM for SaaS security posture monitoring and
-  compliance visibility.
----
-
-# Onboard YouTrack
-
-SaaS Security connects to the YouTrack API using a permanent token that you generate from a YouTrack administrator account. After connecting, SaaS Security scans your YouTrack instance for misconfigured settings.
-
-Onboarding consists of two tasks:
-
-1. Collect the instance name and generate a permanent token
-2. Connect SaaS Security to YouTrack
-
-The onboarding process requires the following credentials:
-
-| Item            | Description                                                                                                                                                  |
-| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Instance Name   | The unique subdomain that identifies your organization's YouTrack instance, as shown in your YouTrack URL: \<instance-name>.youtrack.cloud.                  |
-| Permanent Token | A token generated from a YouTrack administrator account assigned to the System Admin role. The token must be scoped to YouTrack and YouTrack Administration. |
-
-***
-
-#### Task 1 — Collect Information for Accessing Your YouTrack Instance
-
-**Step 1 — Identify your YouTrack instance name**
-
-Open a browser and go to your YouTrack login page. Your instance name is the subdomain shown in the URL: \<instance-name>.youtrack.cloud.
-
-**Note**: Record your instance name before proceeding. You must provide it during onboarding.
-
-**Step 2 — Generate a permanent token**
-
-1. Log in to YouTrack as an administrator assigned to the System Admin role.
-2. Click your account avatar in the upper-right corner and select \<your-avatar> > Profile.
-3. On your profile page, go to Account Security.
-4. In the Tokens section, click New token.
-5. In the New Permanent Token dialog:
-
-* Enter a name for the token.
-* Select the following scopes:
-* YouTrack
-* YouTrack Administration
-
-6. Click Create. YouTrack displays the new permanent token.
-7. Click Copy token and save it to a text file.
-
-Note: Do not proceed until you have copied the token. You must provide it during onboarding.
-
-***
-
-#### Task 2 — Connect SaaS Security to YouTrack
-
-1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
-2. Select **Settings > Data Sources and Integrations > Add New** and click the YouTrack tile.
-3. On the **Capabilities** tab, enter a name for this instance.
-4. Under Default Capabilities, confirm Security Posture is selected.
-5. Click Next.
-6. On the **Connections** tab, enter your Instance Name and Permanent Token.
-7. Click Next.
-8. On the **Configurations** tab:
-   1. Set the Sync Interval.
-   2. (Optional) Add a Tag.
-9. Click **Next** to complete onboarding.

▸ Provider Instances Security Check deleted +0 −33 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/provider-instances-security-check

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,33 +0,0 @@

---

description: >-

Use Cortex XSIAM Provider Instances Security Check to review posture across

onboarded SaaS applications.

---

# Provider Instances Security Check

The Provider Instances page provides a high-level aggregation of tenant security scores and an interactive, list view for analyzing and remediating individual instances.

\

This page consolidates SaaS application security posture data across all onboarded instances:

• Overall Security Check Score: Displays the global average posture score across all integrated instances. Applications are further categorized into three security score-based buckets:

• Up to 50% (Red): Severe posture gaps

• Between 50%–75% (Yellow): Moderate posture alignment

• Over 75% (Green): High posture alignment

• Providers (Distribution Tiles): Lists onboarded SaaS Applications with active instance count for each provider.

Instance Inventory List

The table displays granular telemetry for each active SaaS application.

Provider Instances: The unique, user-defined identifier/name for the specific SaaS tenant. These are hyperlinked to route administrators to the deep-dive configuration and issues page for that specific instance.

• Provider Type: The underlying third-party SaaS vendor platform associated with the instance (e.g., Mural, Cisco Meraki).

• Application Tag: Custom metadata tags assigned to instances to categorize environments for scoped policies and reporting.

• Connector Status: The operational state of the API integration. A green Connected status indicates active, authorized data ingestion.

• Overall Security Check Score: The normalized security score (0–100%) computed for the individual instance.

Click on an instance to view Passed Checks and take action on Failed Checks.

Show markdown source

@@ -1,33 +0,0 @@
----
-description: >-
-  Use Cortex XSIAM Provider Instances Security Check to review posture across
-  onboarded SaaS applications.
----
-
-# Provider Instances Security Check
-
-The **Provider Instances** page provides a high-level aggregation of tenant security scores and an interactive, list view for analyzing and remediating individual instances.
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2Fx9JcEbsgHuDFKPWsALgl%2Funknown.png?alt=media&#x26;token=3516186e-f6fb-4d79-b1ab-b179e6fac8b9" alt="" height="383" width="624">
-
-\
-This page consolidates SaaS application security posture data across all onboarded instances:
-
-* Overall Security Check Score: Displays the global average posture score across all integrated instances. Applications are further categorized into three security score-based buckets:
-* Up to 50% (Red): Severe posture gaps
-* Between 50%–75% (Yellow): Moderate posture alignment
-* Over 75% (Green): High posture alignment
-* Providers (Distribution Tiles): Lists onboarded SaaS Applications with active instance count for each provider.
-
-**Instance Inventory List**
-
-The table displays granular telemetry for each active SaaS application.
-
-Provider Instances: The unique, user-defined identifier/name for the specific SaaS tenant. These are hyperlinked to route administrators to the deep-dive configuration and issues page for that specific instance.
-
-* Provider Type: The underlying third-party SaaS vendor platform associated with the instance (e.g., Mural, Cisco Meraki).
-* Application Tag: Custom metadata tags assigned to instances to categorize environments for scoped policies and reporting.
-* Connector Status: The operational state of the API integration. A green Connected status indicates active, authorized data ingestion.
-* Overall Security Check Score: The normalized security score (0–100%) computed for the individual instance.
-
-Click on an instance to view Passed Checks and take action on Failed Checks.

▸ Remediation Actions deleted +0 −19 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/remediation-actions

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,19 +0,0 @@

---

description: Use Cortex XSIAM remediation actions to resolve SaaS Security issues.

---

# Remediation Actions

Review remediation actions to see a prioritized list of steps you can take to resolve posture issues originating from SaaS Applications. Follow the steps below to view all the Remediation options:

1. Navigate to Modules > SaaS Security > Security Issues > Posture to view a list of all issues with vulnerabilities originating from SaaS Application Posture.

2. Click on any Issue to be taken to the Issue view.

3. Select the Issue you wish to investigate. This opens the Remediation Actions side panel.

4. The detailed side panel provides the following investigation and remediation options:

1. The Overview tab on the Vulnerability Issues panel captures all the relevant details to further investigate the vulnerability including Summary, Details, Affected Assets, and Evidence.

2. Select Resolution to view remediation options including Remediation Guidance. Detailed manual steps are listed to resolve the issue.

3. Click War Room for real-time investigation capabilities. In the War Room you can capture case context from different sources and collaborate and execute remote actions across integrated products.

4. Work Plan is available when you select an autonomous playbook in an issue's resolution tab. This view presents only the executed key tasks and their defined outputs, providing a focused view of resolution actions.

5. Ticketing and Notifications: Jira, Slack, and Service Now integrations are available to create a ticket to resolve any issue. Webhook notification routing is also available for your auditing requirements.

Show markdown source

@@ -1,19 +0,0 @@
----
-description: Use Cortex XSIAM remediation actions to resolve SaaS Security issues.
----
-
-# Remediation Actions
-
-Review remediation actions to see a prioritized list of steps you can take to resolve posture issues originating from SaaS Applications. Follow the steps below to view all the Remediation options:
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2Flblec90lvsYy5z6pvakW%2Funknown.png?alt=media&#x26;token=997c7e80-031e-4115-9c09-33bd384f2d23" alt="" height="416" width="624">
-
-1. Navigate to **Modules > SaaS Security > Security Issues > Posture** to view a list of all issues with vulnerabilities originating from SaaS Application Posture.
-2. Click on any Issue to be taken to the Issue view.
-3. Select the Issue you wish to investigate. This opens the Remediation Actions side panel.
-4. The detailed side panel provides the following investigation and remediation options:
-   1. The **Overview** tab on the Vulnerability Issues panel captures all the relevant details to further investigate the vulnerability including Summary, Details, Affected Assets, and Evidence.
-   2. Select **Resolution** to view remediation options including Remediation Guidance. Detailed manual steps are listed to resolve the issue.
-   3. Click **War Room** for real-time investigation capabilities. In the War Room you can capture case context from different sources and collaborate and execute remote actions across integrated products.
-   4. **Work Plan** is available when you select an autonomous playbook in an issue's resolution tab. This view presents only the executed key tasks and their defined outputs, providing a focused view of resolution actions.
-   5. **Ticketing and Notifications**: Jira, Slack, and Service Now integrations are available to create a ticket to resolve any issue. Webhook notification routing is also available for your auditing requirements.

▸ SaaS AI Agent Security deleted +0 −40 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,40 +0,0 @@

---

description: >-

Use Cortex XSIAM SaaS AI Agent Security to discover, monitor, and secure

enterprise SaaS AI agents.

---

# SaaS AI Agent Security

Cortex's AISPM feature surfaces SaaS AI Agent data to help you tackle the unique challenges of securing AI agents deployed across enterprise SaaS environments. It provides your security teams with comprehensive visibility, proactive threat detection, and automated enforcement mechanisms specifically tailored for agentic platforms.

hint info

Note: SaaS AI Agent Security is currently in Beta with limited availability. Contact your Customer Service Representative to activate AI Agent Security in your environment.

endhint

#### Core Capabilities

AISPM helps protect the autonomous workflows in your cloud environment with following key functionality:

• Visibility & Discovery—Provides a unified inventory and visibility into deployed agents, mitigating against "shadow AI" risks.

• Addresses Security Posture Risks—Issues such as authentication misconfigurations, insecure actions and workflows (e.g., agents forwarding corporate emails to personal addresses).

• Identifies misconfigured privileges where agents may inherit excessive permissions, allowing unintended access or actions.

• Exposes Threats such as vulnerabilities that may lead to injection attacks via System Prompts, Tools or Skills.

#### Supported Agent Platforms

AISPM is designed to onboard and secure a wide array of modern enterprise AI agent platforms, including:

• Atlassian Rovo

• Box AI Agents

• ChatGPT Enterprise

• Cursor Enterprise

• Gemini Enterprise

• Microsoft 365 Copilot and Copilot Studio

• ServiceNow AI Platform

AISPM provides a comprehensive view of all SaaS agents, their configurations, and security postures, offering end-to-end auditability and high-level dashboards for governance across your organization.

Show markdown source

@@ -1,40 +0,0 @@
----
-description: >-
-  Use Cortex XSIAM SaaS AI Agent Security to discover, monitor, and secure
-  enterprise SaaS AI agents.
----
-
-# SaaS AI Agent Security
-
-Cortex's AISPM feature surfaces SaaS AI Agent data to help you tackle the unique challenges of securing AI agents deployed across enterprise SaaS environments. It provides your security teams with comprehensive visibility, proactive threat detection, and automated enforcement mechanisms specifically tailored for agentic platforms.
-
-{% hint style="info" %}
-Note: SaaS AI Agent Security is currently in Beta with limited availability. Contact your Customer Service Representative to activate AI Agent Security in your environment.
-{% endhint %}
-
-#### Core Capabilities
-
-AISPM helps protect the autonomous workflows in your cloud environment with following key functionality:
-
-* Visibility & Discovery—Provides a unified inventory and visibility into deployed agents, mitigating against "shadow AI" risks.
-* Addresses Security Posture Risks—Issues such as authentication misconfigurations, insecure actions and workflows (e.g., agents forwarding corporate emails to personal addresses).
-* Identifies misconfigured privileges where agents may inherit excessive permissions, allowing unintended access or actions.
-* Exposes Threats such as vulnerabilities that may lead to injection attacks via System Prompts, Tools or Skills.
-
-<figure><img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FZ2JWDH5pHy0Fp3X0W3vf%2Fimage.png?alt=media&#x26;token=ef2ee3e7-fe2d-4ab8-8cc5-23d2ad2411b9" alt=""><figcaption></figcaption></figure>
-
-#### Supported Agent Platforms
-
-AISPM is designed to onboard and secure a wide array of modern enterprise AI agent platforms, including:
-
-* Atlassian Rovo
-* Box AI Agents
-* ChatGPT Enterprise
-* Cursor Enterprise
-* Gemini Enterprise
-* Microsoft 365 Copilot and Copilot Studio
-* ServiceNow AI Platform
-
-AISPM provides a comprehensive view of all SaaS agents, their configurations, and security postures, offering end-to-end auditability and high-level dashboards for governance across your organization.
-
-<br>

▸ Manage SaaS AI Agents deleted +0 −11 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/manage-saas-ai-agents

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,11 +0,0 @@

---

description: >-

Manage SaaS AI agents in Cortex XSIAM, including agents, datasets, and

connected tools.

---

# Manage SaaS AI Agents

AISPM provides comprehensive management tools to monitor and control your AI agent ecosystem. Through centralized visibility, you can track agent activity, assess security posture, and perform targeted remediation to mitigate risks associated with autonomous workflows.

Show markdown source

@@ -1,11 +0,0 @@
----
-description: >-
-  Manage SaaS AI agents in Cortex XSIAM, including agents, datasets, and
-  connected tools.
----
-
-# Manage SaaS AI Agents
-
-AISPM provides comprehensive management tools to monitor and control your AI agent ecosystem. Through centralized visibility, you can track agent activity, assess security posture, and perform targeted remediation to mitigate risks associated with autonomous workflows.
-
-<br>

▸ View Agent Tools deleted +0 −26

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-agent-tools

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,26 +0,0 @@

---

description: >-

Use Cortex XSIAM SaaS AI Agent Security to view tools connected to discovered

AI agents.

---

# View Agent Tools

The SaaS Agent Tools security page moves beyond assessment of tools to the real security surface the—Tool Wrapper (or "Agent Tool" instance). This is the configuration layer where an agent author defines how a tool is used. This analysis often reveals risks like overprivileged access, or insecure credentialing that arise here and not in the underlying function code.

An Agent Tool is a specific instance of a tool being utilized by a specific agent. It acts as a wrapper that encapsulates:

1. Metadata Aliases: Custom names and descriptions provided by the agent author Configuration Settings: How the tool is pointed at specific data stores or environments

2. Authentication/Identity: Whether the tool executes using a System Credential, a specific Service Account, or prompts the User on-the-fly.

The SaaS Agent Tool page and dashboard focuses exclusively on posture risks introduced by the misconfiguration of the Agent Tool Wrapper layer.

Utilize the SaaS Agent tools widgets to view the potential risks introduced. These widgets provide insights into the total number of Providers and the Risk Breakdown. Select any provider from the page view to see a detailed breakdown of the following:

• Overview: Provides detailed information information on the tool Metadata

• AI Ecosystem: This node-based graph shows the specific Parent Agent and all the Datastores and API connections accessed by the Tool.

• Related Agents: Lists linked agents using this specific tool configuration.

Show markdown source

@@ -1,26 +0,0 @@
----
-description: >-
-  Use Cortex XSIAM SaaS AI Agent Security to view tools connected to discovered
-  AI agents.
----
-
-# View Agent Tools
-
-The SaaS Agent Tools security page moves beyond assessment of tools to the real security surface the—Tool Wrapper (or "Agent Tool" instance). This is the configuration layer where an agent author defines how a tool is used. This analysis often reveals risks like overprivileged access, or insecure credentialing that arise here and not in the underlying function code.
-
-An Agent Tool is a specific instance of a tool being utilized by a specific agent. It acts as a wrapper that encapsulates:
-
-1. Metadata Aliases: Custom names and descriptions provided by the agent author Configuration Settings: How the tool is pointed at specific data stores or environments
-2. Authentication/Identity: Whether the tool executes using a System Credential, a specific Service Account, or prompts the User on-the-fly.
-
-The SaaS Agent Tool page and dashboard focuses exclusively on posture risks introduced by the misconfiguration of the Agent Tool Wrapper layer.
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FEFjdVlNgadB1hh9hGVo3%2Funknown.png?alt=media&#x26;token=ac5762a3-f0a9-4cc6-ad51-8968247b3c00" alt="" height="361" width="624">
-
-Utilize the SaaS Agent tools widgets to view the potential risks introduced. These widgets provide insights into the total number of Providers and the Risk Breakdown. Select any provider from the page view to see a detailed breakdown of the following:
-
-* Overview: Provides detailed information information on the tool Metadata
-* AI Ecosystem: This node-based graph shows the specific Parent Agent and all the Datastores and API connections accessed by the Tool.
-* Related Agents: Lists linked agents using this specific tool configuration.
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FMfq4641ZGXqP5uBTl4g8%2Funknown.png?alt=media&#x26;token=fb8f927c-3042-4e5d-be79-938fd5e336db" alt="" height="411" width="624">

▸ View AI Agents deleted +0 −28

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-ai-agents

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,28 +0,0 @@

---

description: >-

View SaaS AI agents discovered by Cortex XSIAM and assess their security

context.

---

# View AI Agents

AISPM provides you with a holistic view of all the agents deployed in your cloud environments. Start with a high-level view of all the agents deployed across all agentic platforms and drill down further to view all the active agents for a single platform.

### View Agents Security Posture

You can view SaaS Agents assets and other actionable data from the SaaS Security Overview page. Follow the steps below to view Agent activity:

1. SaaS Agents Overview

1. Navigate to Home > Modules > SaaS Security > Saas Security Overview.

2. Hover over the AI Security icon to view Assets at Risk and their severity level, Overprivileged Agents, Agents with Sensitive Data, Inactive Agents.

3. Select View Assets to go to the Agents list view.

4. Navigate to Home > Modules > SaaS Security > AI Agents to view all agents by agentic platform. Click on any agentic platform such as Service Now to view all agents currently deployed. You can further filter this list to double click on activity such dormant periods or delegation authority.

5. From the all AI Agents list view you can also click on any agent to view all available actions you can take to remediate non-compliant agents.

3. Select the Dashboard link on the AI Agents list view page to be redirected to the complete Asset Inventory dashboard that provides a comprehensive look at all AI Assets including details such as Risk Breakdown, Providers, and Insights.

Show markdown source

@@ -1,28 +0,0 @@
----
-description: >-
-  View SaaS AI agents discovered by Cortex XSIAM and assess their security
-  context.
----
-
-# View AI Agents
-
-AISPM provides you with a holistic view of all the agents deployed in your cloud environments. Start with a high-level view of all the agents deployed across all agentic platforms and drill down further to view all the active agents for a single platform.
-
-### View Agents Security Posture
-
-You can view SaaS Agents assets and other actionable data from the SaaS Security Overview page. Follow the steps below to view Agent activity:
-
-1. SaaS Agents Overview
-   1. Navigate to **Home > Modules > SaaS Security > Saas Security Overview**.
-   2. Hover over the AI Security icon to view Assets at Risk and their severity level, Overprivileged Agents, Agents with Sensitive Data, Inactive Agents.
-   3. Select **View Assets** to go to the Agents list view.
-   4. Navigate to **Home > Modules > SaaS Security > AI Agents** to view all agents by agentic platform. Click on any agentic platform such as Service Now to view all agents currently deployed. You can further filter this list to double click on activity such dormant periods or delegation authority.
-   5. From the all AI Agents list view you can also click on any agent to view all available actions you can take to remediate non-compliant agents.
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2F2wMvAZrKE6qOFfOJPwGK%2Funknown.png?alt=media&#x26;token=02a835d8-9098-43e3-aca1-9c1c4db6f4cf" alt="" height="393" width="624">
-
-3. Select the Dashboard link on the AI Agents list view page to be redirected to the complete Asset Inventory dashboard that provides a comprehensive look at all AI Assets including details such as Risk Breakdown, Providers, and Insights.
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FVWhiJAa3P0dV7xRRIaHg%2Funknown.png?alt=media&#x26;token=12ba98e2-5267-48e5-94bf-45cf14643796" alt="" height="385" width="624">
-
-<br>

▸ View Datasets deleted +0 −22

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-datasets

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,22 +0,0 @@

---

description: >-

Use Cortex XSIAM SaaS AI Agent Security to view inference datasets associated

with discovered AI agents.

---

# View Datasets

A Dataset is a collection of unseen, raw data, used by SaaS Agents to generate predictions, classifications, or recommendations. The Datasets view within the SaaS Security module (Modules > SaaS Security > Asset Inventory > Datasets) provides an aggregated overview and granular table of Cloud Datasets as well as datasets ingested, generated, or utilized by connected SaaS applications and AI agents.

The top section contains three analytical widgets summarizing the current security and provider posture of the dataset inventory. Widgets include:

• Risk Breakdown: Displays the proportion of monitored datasets containing unresolved security vulnerabilities, policy violations, or anomalous access patterns.

• Providers: Tracks datasets exposed to the public internet or accessible outside authorized organizational boundaries.

From the List View you can click on any Dataset to view the entire Agent ecosystem. Select any option below to investigate further:

• Overview: Provides details such as Provider name, Owner, and Descriptions.

• AI Ecosystem: Provides a graphical view of the tools connected to the Dataset.

• Related Agents: Includes agent identity insights, tracking of dormant agents, as well as a breakdown of risks associated with agents connected to the Dataset.

Show markdown source

@@ -1,22 +0,0 @@
----
-description: >-
-  Use Cortex XSIAM SaaS AI Agent Security to view inference datasets associated
-  with discovered AI agents.
----
-
-# View Datasets
-
-A Dataset is a collection of unseen, raw data, used by SaaS Agents to generate predictions, classifications, or recommendations. The Datasets view within the SaaS Security module (**Modules > SaaS Security > Asset Inventory > Datasets**) provides an aggregated overview and granular table of Cloud Datasets as well as datasets ingested, generated, or utilized by connected SaaS applications and AI agents.
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2F4lNDIitKkLLLQiikPSQ6%2Funknown.png?alt=media&#x26;token=c3bd45c0-eae2-419b-b32a-c0eaa04bd2b7" alt="" height="361" width="624">
-
-The top section contains three analytical widgets summarizing the current security and provider posture of the dataset inventory. Widgets include:
-
-* Risk Breakdown: Displays the proportion of monitored datasets containing unresolved security vulnerabilities, policy violations, or anomalous access patterns.
-* Providers: Tracks datasets exposed to the public internet or accessible outside authorized organizational boundaries.
-
-From the List View you can click on any Dataset to view the entire Agent ecosystem. Select any option below to investigate further:
-
-* Overview: Provides details such as Provider name, Owner, and Descriptions.
-* AI Ecosystem: Provides a graphical view of the tools connected to the Dataset.
-* Related Agents: Includes agent identity insights, tracking of dormant agents, as well as a breakdown of risks associated with agents connected to the Dataset.

▸ Onboard SaaS AI Agents deleted +0 −22 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,22 +0,0 @@

---

description: >-

Onboard supported SaaS AI agents to Cortex XSIAM for AI agent security

visibility and control.

---

# Onboard SaaS AI Agents

As you increasingly integrate AI agents—software powered by Large Language Models (LLMs) that connect to your enterprise systems and utilize memory to execute workflows—you also introduce new attack vectors. Effectively onboarding your AI agent platforms into a comprehensive AISPM framework is the critical first step to managing these risks.

Onboard your new and existing SaaS-based agent platforms to establish a secure, compliant cloud environment. Select a specific SaaS AI Agent to onboard:

• Atlassian Rovo

• Box AI Agents

• ChatGPT Enterprise

• Cursor Enterprise

• Gemini Enterprise

• Microsoft 365 Copilot

• Microsoft Copilot Studio

• ServiceNow AI Platform

Show markdown source

@@ -1,22 +0,0 @@
----
-description: >-
-  Onboard supported SaaS AI agents to Cortex XSIAM for AI agent security
-  visibility and control.
----
-
-# Onboard SaaS AI Agents
-
-As you increasingly integrate AI agents—software powered by Large Language Models (LLMs) that connect to your enterprise systems and utilize memory to execute workflows—you also introduce new attack vectors. Effectively onboarding your AI agent platforms into a comprehensive AISPM framework is the critical first step to managing these risks.
-
-Onboard your new and existing SaaS-based agent platforms to establish a secure, compliant cloud environment. Select a specific SaaS AI Agent to onboard:
-
-* [Atlassian Rovo](onboard-saas-ai-agents/onboard-atlassian-rovo)
-* [Box AI Agents](onboard-saas-ai-agents/onboard-box-ai-agents)
-* [ChatGPT Enterprise](onboard-saas-ai-agents/onboard-chatgpt-enterprise)
-* [Cursor Enterprise](onboard-saas-ai-agents/onboard-cursor-enterprise)
-* [Gemini Enterprise](onboard-saas-ai-agents/onboard-gemini-enterprise)
-* [Microsoft 365 Copilot](onboard-saas-ai-agents/onboard-m365-copilot)
-* [Microsoft Copilot Studio](onboard-saas-ai-agents/onboard-microsoft-copilot-studio)
-* [ServiceNow AI Platform](onboard-saas-ai-agents/onboard-service-now)
-
-<br>

▸ Onboard Atlassian Rovo deleted +0 −39

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-atlassian-rovo

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,39 +0,0 @@

---

description: >-

Onboard Atlassian Rovo to Cortex XSIAM SaaS AI Agent Security for visibility

and control.

---

# Onboard Atlassian Rovo

To access your Atlassian instance, AISPM requires the following information, which you will specify during the onboarding process.

Admin Email│The login email address of the Atlassian Org Admin who created the API token and API key.

| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

API Token│A token, generated by an Atlassian Org Admin, enables SSPM to authenticate to the administrator account.

API Key│A key, generated by an Atlassian Org Admin, that enables SSPM to scan and update organization settings and user accounts. SSPM uses this key to identify and manage the third-party plugins that users have connected to Jira or Confluence.

Organization ID│A unique, automatically generated identifier for your Atlassian Cloud account, serving as the primary identifier for managing users, products, billing, and settings centrally within the Atlassian ecosystem. Unlike organization names, which aren't unique, the Organization ID guarantees each organization has its own distinct identifier for use in the URL, API, and various integrations.

1. Generate and Copy an Administrator API Token.

1. Log in to Atlassian using Org Admin credentials.

2. From the Atlassian account profile, navigate to the API tokens page for the account (select Security > Create and manage API tokens or go to id.atlassian.com/manage-profile/security/api-tokens).

3. Click Create API Token.

4. Specify a name and an expiry date for your API token and click Create.

5. Copy the generated API token. Do not continue to the next step unless you have copied it, as you must provide this token during the onboarding process.

2. Generate and Copy an API Key and an Organization ID.

1. Log in to the Atlassian Admin Portal (admin.atlassian.com) using Org Admin credentials.

2. If you administer more than one Atlassian organization, select the organization you want SSPM to scan.

3. Select Organization settings > API keys.

4. Click Create API key.

5. In the "Before you begin" page, choose "API key without scopes" and click Next.

6. Specify a name and an expiry date for the key and click Next.

7. Review your API Key details and click Create API key.

8. Copy the Organization ID and the API key. Do not continue to the next step unless you have copied both, as you must provide this information during the onboarding process.

3. Onboard Atlassian Rovo Platform to Cortex.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the Atlassian connector.

3. Click on the Atlassian tile and select the Add Another Instance.

4. On the Capabilities page, provide an Instance Name and select the Agent Security scanning capability.

5. Under Connections, provide Admin Email and Organization ID to authorize the connection. In addition, under Agent Security Scanning, provide the API Key and API Token to authenticate the application.

6. Once Cortex validates the credentials and permissions, the onboarding process is complete.

4. Validation and Scanning: Cortex will immediately begin scanning your onboarded platform. Note that scan time varies based on the amount of data; it takes at least one hour to display data in the AISPM dashboard.

Show markdown source

@@ -1,39 +0,0 @@
----
-description: >-
-  Onboard Atlassian Rovo to Cortex XSIAM SaaS AI Agent Security for visibility
-  and control.
----
-
-# Onboard Atlassian Rovo
-
-To access your Atlassian instance, AISPM requires the following information, which you will specify during the onboarding process.
-
-| Admin Email     | <p>The login email address of the Atlassian Org Admin who created the API token and API key.</p><p><br></p>                                                                                                                                                                                                                                                                                        |
-| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| API Token       | A token, generated by an Atlassian Org Admin, enables SSPM to authenticate to the administrator account.                                                                                                                                                                                                                                                                                           |
-| API Key         | A key, generated by an Atlassian Org Admin, that enables SSPM to scan and update organization settings and user accounts. SSPM uses this key to identify and manage the third-party plugins that users have connected to Jira or Confluence.                                                                                                                                                       |
-| Organization ID | A unique, automatically generated identifier for your Atlassian Cloud account, serving as the primary identifier for managing users, products, billing, and settings centrally within the Atlassian ecosystem. Unlike organization names, which aren't unique, the Organization ID guarantees each organization has its own distinct identifier for use in the URL, API, and various integrations. |
-
-1. Generate and Copy an Administrator API Token.
-   1. Log in to Atlassian using Org Admin credentials.
-   2. From the Atlassian account profile, navigate to the API tokens page for the account (select Security > Create and manage API tokens or go to [id.atlassian.com/manage-profile/security/api-tokens](https://id.atlassian.com/manage-profile/security/api-tokens)).
-   3. Click Create API Token.
-   4. Specify a name and an expiry date for your API token and click Create.
-   5. Copy the generated API token. Do not continue to the next step unless you have copied it, as you must provide this token during the onboarding process.
-2. Generate and Copy an API Key and an Organization ID.
-   1. Log in to the [Atlassian Admin Portal](http://admin.atlassian.com/) (admin.atlassian.com) using Org Admin credentials.
-   2. If you administer more than one Atlassian organization, select the organization you want SSPM to scan.
-   3. Select Organization settings > API keys.
-   4. Click Create API key.
-   5. In the "Before you begin" page, choose "API key without scopes" and click Next.
-   6. Specify a name and an expiry date for the key and click Next.
-   7. Review your API Key details and click Create API key.
-   8. Copy the Organization ID and the API key. Do not continue to the next step unless you have copied both, as you must provide this information during the onboarding process.
-3. Onboard Atlassian Rovo Platform to Cortex.
-   1. Log in to Cortex.
-   2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the Atlassian connector.
-   3. Click on the Atlassian tile and select the Add Another Instance.
-   4. On the **Capabilities** page, provide an Instance Name and select the Agent Security scanning capability.
-   5. Under **Connections**, provide **Admin Email** and **Organization ID** to authorize the connection. In addition, under **Agent Security Scanning**, provide the API Key and API Token to authenticate the application.
-   6. Once Cortex validates the credentials and permissions, the onboarding process is complete.
-4. **Validation and Scanning**: Cortex will immediately begin scanning your onboarded platform. Note that scan time varies based on the amount of data; it takes at least one hour to display data in the AISPM dashboard.

▸ Onboard Box AI Agents deleted +0 −52

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-box-ai-agents

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,52 +0,0 @@

---

description: >-

Onboard Box AI Agents to Cortex XSIAM SaaS AI Agent Security for visibility

and control.

---

# Onboard Box AI Agents

Prerequisites

• Ensure you have the necessary administrative privileges in your Box instance, including the ability to access the Admin and Dev console.

• To access Box AI Studio and start building custom agents, your organization must have a Box - Enterprise Advanced license. If you would like to explore these capabilities, coordinate with your IT Administrator or Box Sales representative to ensure the proper licensing is in place.

Note: Box AI Studio is a Microsoft-native product, not a feature developed or managed by Palo Alto Networks.

• Ensure you have enabled Box AI. To do this, go to your Box instance > Box AI > Settings and click Enable Box AI.

1. Create and Configure a Custom Box App

1. Sign in to your Box instance.

2. From the left navigation pane, select Dev Console > Create Platform App > Custom App.

3. On the Custom App page, enter the following information:

1. Give a suitable App Name.

2. Give a suitable Description (optional).

3. For Purpose, choose Automation from the drop-down and click Next.

4. Select Server Authentication (Client Credentials Grant) for the authentication method and click Create App.

5. On the newly created app page, select the Configuration tab.

6. In the OAuth 2.0 Credentials section, copy the Client ID and the Client Secret (Fetch Client Secret) and keep it handy for use during onboarding.

7. In the App Access Level section, choose App+Enterprise Access.

8. In the Application Scopes > Content Actions section, ensure you select the following checkbox options:

1. Read all files and folders stored in Box.

2. Write all files and folders stored in Box.

3. Manage AI.

9. Ensure you deselect all other checkbox options under Application Scopes > Administrative Actions and Application Scopes > Developer Actions.

10. Click Save Changes.

11. Back on the newly created app page, select Authorization > Review and Submit and then click Submit. Your new app will move to the Pending Authorization state.

2. Authorize the App in the Admin Console.

1. Click Back to My Account on the left navigation pane and select Admin Console > Integrations > Platform Apps Manager.

2. On the Server Authentication Apps list, find the app you created and select ... > Authorize App > Authorize.

3. Retrieve the Enterprise ID

1. Go Back to My Account > Dev Console and select the app you created.

2. Copy the Enterprise ID (available in the General Settings tab).

**Note**: Ensure you repeat the authorization process again if you modify any settings during configuration.

4. Onboard Box AI Agents to Cortex:

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the Box connector.

3. You may find multiple Box tiles, select the Box titled Box integration for SaaS Data and Posture Security for Box. Click on the tile and select the Add Another Instance.

4. On the Capabilities page, provide an Instance Name and select the Agent Security scanning capability.

5. On the Connections page, provide your Instance URL and select the Recommended authentication method. Provide your Client ID and Client Secret for the authentication flow.

6. Once Cortex validates the credentials and permissions, the onboarding process is complete.

5. Validation and Scanning: Cortex validates the credentials and permissions. After the validation is successful, you will see a confirmation message. Scanning begins immediately after a successful validation. The amount of time Cortex takes to scan varies based on the amount of scan data. At a minimum, it takes at least one hour to scan and display data in the Cortex dashboard.

Show markdown source

@@ -1,52 +0,0 @@
----
-description: >-
-  Onboard Box AI Agents to Cortex XSIAM SaaS AI Agent Security for visibility
-  and control.
----
-
-# Onboard Box AI Agents
-
-**Prerequisites**
-
-* Ensure you have the necessary administrative privileges in your Box instance, including the ability to access the Admin and Dev console.
-* To access Box AI Studio and start building custom agents, your organization must have a Box - Enterprise Advanced license. If you would like to explore these capabilities, coordinate with your IT Administrator or Box Sales representative to ensure the proper licensing is in place.
-
-**Note**: Box AI Studio is a Microsoft-native product, not a feature developed or managed by Palo Alto Networks.
-
-* Ensure you have enabled Box AI. To do this, go to your **Box instance > Box AI > Settings** and click **Enable Box AI**.
-
-1. Create and Configure a Custom Box App
-   1. Sign in to your Box instance.
-   2. From the left navigation pane, select Dev Console > Create Platform App > Custom App.
-   3. On the Custom App page, enter the following information:
-      1. Give a suitable App Name.
-      2. Give a suitable Description (optional).
-      3. For Purpose, choose Automation from the drop-down and click Next.
-   4. Select Server Authentication (Client Credentials Grant) for the authentication method and click Create App.
-   5. On the newly created app page, select the Configuration tab.
-   6. In the OAuth 2.0 Credentials section, copy the Client ID and the Client Secret (Fetch Client Secret) and keep it handy for use during onboarding.
-   7. In the App Access Level section, choose App+Enterprise Access.
-   8. In the Application Scopes > Content Actions section, ensure you select the following checkbox options:
-      1. Read all files and folders stored in Box.
-      2. Write all files and folders stored in Box.
-      3. Manage AI.
-   9. Ensure you deselect all other checkbox options under Application Scopes > Administrative Actions and Application Scopes > Developer Actions.
-   10. Click Save Changes.
-   11. Back on the newly created app page, select Authorization > Review and Submit and then click Submit. Your new app will move to the Pending Authorization state.
-2. Authorize the App in the Admin Console.
-   1. Click Back to My Account on the left navigation pane and select Admin Console > Integrations > Platform Apps Manager.
-   2. On the Server Authentication Apps list, find the app you created and select ... > Authorize App > Authorize.
-3.  Retrieve the Enterprise ID
-
-    1. Go Back to My Account > Dev Console and select the app you created.
-    2. Copy the Enterprise ID (available in the General Settings tab).
-
-    **Note**: Ensure you repeat the authorization process again if you modify any settings during configuration.
-4. Onboard Box AI Agents to Cortex:
-   1. Log in to Cortex.
-   2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the Box connector.
-   3. You may find multiple Box tiles, select the Box titled **Box integration for SaaS Data** and **Posture Security for Box**. Click on the tile and select the Add Another Instance.
-   4. On the **Capabilities** page, provide an Instance Name and select the Agent Security scanning capability.
-   5. On the **Connections** page, provide your Instance URL and select the Recommended authentication method. Provide your Client ID and Client Secret for the authentication flow.
-   6. Once Cortex validates the credentials and permissions, the onboarding process is complete.
-5. **Validation and Scanning**: Cortex validates the credentials and permissions. After the validation is successful, you will see a confirmation message. Scanning begins immediately after a successful validation. The amount of time Cortex takes to scan varies based on the amount of scan data. At a minimum, it takes at least one hour to scan and display data in the Cortex dashboard.

▸ Onboard ChatGPT Enterprise deleted +0 −38

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-chatgpt-enterprise

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,38 +0,0 @@

---

description: >-

Onboard ChatGPT Enterprise to Cortex XSIAM SaaS AI Agent Security for

visibility and control.

---

# Onboard ChatGPT Enterprise

1. ChatGPT Enterprise & OpenAI Configuration

1. Sign in to your ChatGPT Enterprise instance.

2. Fetch the Organization ID and Workspace ID from ChatGPT Settings:

1. Select ChatGPT > Manage Workspace > Settings and keep them handy.

3. To fetch the Secret Key, go to the OpenAI API-Keys site and click + Create new secret key.

1. In the Create new secret key page, enter the required details and click Create secret key.

2. During key generation, ensure that the Permissions is set to All. (OpenAI will revoke it in the subsequent steps).

4. Ensure that this key is generated in the same Organization as your ChatGPT tenant. To confirm this, select Settings on the OpenAI website and ensure the Org ID is the same as what you fetched previously.

5. Copy the new key and keep it handy.

6. To enable the generated key for the Compliance API scopes, send an email to support@openai.com with the following information:

1. Last 4 characters of the generated API Key

2. Key Name

3. Created By Name

4. Requested Scope - Read. Ensure that the generated key is unique for AISPM and not used in any other product. For example, you cannot use the same key for both Data Security and AISPM since the scope is different for both of them.

5. Organization ID

**Note**: Further instructions are available in the ChatGPT API Reference.

2. After OpenAI enables the key for the Compliance API, proceed to add the ChatGPT Enterprise connector.

3. Onboarding ChatGPT to Cortex:

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the ChatGPT connector.

3. Click on the ChatGPT tile and select the Add Another Instance.

4. On the Capabilities page, provide an Instance Name and select Agent Security scanning capability.

5. On the Connections page, provide your Instance URL and select the Recommended authentication method, enter the following information (that you gathered in the steps above and click Complete:

1. Organization ID

2. Workspace ID

3. API Key

6. Once Cortex validates the credentials and permissions, the onboarding process is complete.

4. Validation and Scanning: Cortex establishes the API connection and validates the credentials and permissions. After the validation is successful, you will see a confirmation message. Scan periods vary based on the amount of data it is required to scan. At a minimum, it takes at least one hour to scan and display data in the AISPM dashboard.

Show markdown source

@@ -1,38 +0,0 @@
----
-description: >-
-  Onboard ChatGPT Enterprise to Cortex XSIAM SaaS AI Agent Security for
-  visibility and control.
----
-
-# Onboard ChatGPT Enterprise
-
-1. ChatGPT Enterprise & OpenAI Configuration
-   1. Sign in to your ChatGPT Enterprise instance.
-   2. Fetch the Organization ID and Workspace ID from ChatGPT Settings:
-      1. Select ChatGPT > Manage Workspace > Settings and keep them handy.
-   3. To fetch the Secret Key, go to the OpenAI API-Keys site and click + Create new secret key.
-      1. In the Create new secret key page, enter the required details and click Create secret key.
-      2. During key generation, ensure that the Permissions is set to All. (OpenAI will revoke it in the subsequent steps).
-   4. Ensure that this key is generated in the same Organization as your ChatGPT tenant. To confirm this, select Settings on the OpenAI website and ensure the Org ID is the same as what you fetched previously.
-   5. Copy the new key and keep it handy.
-   6.  To enable the generated key for the Compliance API scopes, send an email to support@openai.com with the following information:
-
-       1. Last 4 characters of the generated API Key
-       2. Key Name
-       3. Created By Name
-       4. Requested Scope - Read. Ensure that the generated key is unique for AISPM and not used in any other product. For example, you cannot use the same key for both Data Security and AISPM since the scope is different for both of them.
-       5. Organization ID
-
-       **Note**: Further instructions are available in the ChatGPT API Reference.
-2. After OpenAI enables the key for the Compliance API, proceed to add the ChatGPT Enterprise connector.
-3. Onboarding ChatGPT to Cortex:
-   1. Log in to Cortex.
-   2. Select **Settings > Data Sources and Integrations > Add New.** You can use the Search bar to find the ChatGPT connector.
-   3. Click on the ChatGPT tile and select the **Add Another Instance**.
-   4. On the **Capabilities** page, provide an Instance Name and select Agent Security scanning capability.
-   5. On the **Connections** page, provide your Instance URL and select the Recommended authentication method, enter the following information (that you gathered in the steps above and click Complete:
-      1. Organization ID
-      2. Workspace ID
-      3. API Key
-   6. Once Cortex validates the credentials and permissions, the onboarding process is complete.
-4. Validation and Scanning: Cortex establishes the API connection and validates the credentials and permissions. After the validation is successful, you will see a confirmation message. Scan periods vary based on the amount of data it is required to scan. At a minimum, it takes at least one hour to scan and display data in the AISPM dashboard.

▸ Onboard Cursor Enterprise deleted +0 −23

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-cursor-enterprise

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,23 +0,0 @@

---

description: >-

Onboard Cursor Enterprise to Cortex XSIAM SaaS AI Agent Security for

visibility and control.

---

# Onboard Cursor Enterprise

Cursor Enterprise is the secure, scalable version of Cursor, an AI-powered code editor built on VS Code. It is designed for large organizations needing advanced features like SSO, audit logs, usage analytics, and data privacy controls to manage AI-assisted software development for complex codebases. It provides features such as IP allowlisting, team management, centralized security, and compliance tools (GDPR, CCPA, SOC 2) to meet enterprise security and governance needs, allowing teams to build faster and more efficiently.

Important: Due to Cursor Enterprise API restrictions, any discovery for Tools and Knowledge Bases is limited to the last 30 days. If you want to increase this duration, contact Technical Support.

1. Create an Admin API Key in Cursor Enterprise.

1. Go to the Cursor Enterprise dashboard and select Settings > API Keys > New API Key.

2. Copy the generated Admin API Key and keep it handy for the onboarding steps.

2. Onboard Cursor Enterprise to Cortex.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the Cursor connector.

3. Click on the Cursor tile and select Add Another Instance.

4. On the Capabilities page, provide an Instance Name and select Agent Security scanning capability.

5. On the Connections page, provide your Instance URL and enter your API Key to initiate the authentication flow.

6. Once AISPM validates the credentials and permissions, the onboarding process is complete.

3. Validation and Scanning: Cortex establishes the connection and validates the credentials and permissions. After successful validation, you will see a confirmation message. The amount of time Cortex takes to scan varies based on the amount of data it is required to scan. At a minimum, it takes at least one hour to scan and display data in the AISPM dashboard.

Show markdown source

@@ -1,23 +0,0 @@
----
-description: >-
-  Onboard Cursor Enterprise to Cortex XSIAM SaaS AI Agent Security for
-  visibility and control.
----
-
-# Onboard Cursor Enterprise
-
-Cursor Enterprise is the secure, scalable version of Cursor, an AI-powered code editor built on VS Code. It is designed for large organizations needing advanced features like SSO, audit logs, usage analytics, and data privacy controls to manage AI-assisted software development for complex codebases. It provides features such as IP allowlisting, team management, centralized security, and compliance tools (GDPR, CCPA, SOC 2) to meet enterprise security and governance needs, allowing teams to build faster and more efficiently.
-
-**Important**: Due to Cursor Enterprise API restrictions, any discovery for Tools and Knowledge Bases is limited to the last 30 days. If you want to increase this duration, contact Technical Support.
-
-1. Create an Admin API Key in Cursor Enterprise.
-   1. Go to the Cursor Enterprise dashboard and select Settings > API Keys > New API Key.
-   2. Copy the generated Admin API Key and keep it handy for the onboarding steps.
-2. Onboard Cursor Enterprise to Cortex.
-   1. Log in to Cortex.
-   2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the Cursor connector.
-   3. Click on the Cursor tile and select **Add Another Instance**.
-   4. On the **Capabilities** page, provide an Instance Name and select Agent Security scanning capability.
-   5. On the **Connections** page, provide your Instance URL and enter your API Key to initiate the authentication flow.
-   6. Once AISPM validates the credentials and permissions, the onboarding process is complete.
-3. Validation and Scanning: Cortex establishes the connection and validates the credentials and permissions. After successful validation, you will see a confirmation message. The amount of time Cortex takes to scan varies based on the amount of data it is required to scan. At a minimum, it takes at least one hour to scan and display data in the AISPM dashboard.

▸ Onboard Gemini Enterprise deleted +0 −36

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-gemini-enterprise

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,36 +0,0 @@

---

description: >-

Onboard Gemini Enterprise to Cortex XSIAM SaaS AI Agent Security for

visibility and control.

---

# Onboard Gemini Enterprise

Gemini allows employees to use pre-built agents or create their own custom agents to perform tasks, analyze data, and automate workflows by securely connecting to company data and applications like Google Workspace and Salesforce. The platform aims to shift employees from tedious tasks to high-impact work while providing central governance and security.

To access your Gemini Enterprise instance, AISPM requires the following specific information during the configuration process:

Item│Description

| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

Service Account Email│A service account email in Gemini Enterprise is a special non-human account. Applications and virtual machines use this account to authenticate and access Google Cloud resources securely. It provides a secure identity for programmatic access to the Gemini for Google Cloud API and related services.

Project ID│A Project ID in Gemini Enterprise is a unique identifier for a Google Cloud project. Gemini Enterprise uses the Google Cloud platform, so its services and resources are organized within the same project structure. A Project ID is needed for authentication, billing, and access control when working with Gemini models and related services.

Location│In Google Cloud's Gemini Enterprise, a "location" is a specific geographic area for creating, processing, and storing data. Location selection allows enterprises to control data residency. This control is important for data privacy, compliance, and meeting requirements in different regions.

Note: New locations created by Gemini Enterprise will be added by AISPM in a phased manner.

1. Configure Google Cloud Console.

1. Go to your project home page (where you developed your agent) in the Google Cloud console. Copy your project ID and project number and keep it handy for onboarding later.

2. From the Google Cloud console, select Menu > APIs & Services > Enabled APIs & Services > +Enable APIs and services.

3. To create a new service account, select Menu > IAM & Admin > Service Accounts > +Create service account.

4. In the list of service accounts, click on the service account that you just created. The service account details are displayed. Copy the service account email address and keep it handy for onboarding later.

5. Select Principals with access > View by principals > Grant access.

6. In the Add principals section, specify the name of the principal.

7. In the Assign roles section, select the Service Account Token Creator role and click Save.

2. Onboard Platform to AISPM

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the Gemini Enterprise connector.

3. Click on the Gemini Enterprise tile and select Add Another Instance.

4. On the Capabilities page, provide an Instance Name and select Agent Security scanning capability.

5. On the Connections page enter the following information that you gathered in Step 1:

1. Project ID (You can use either the project ID or the project number.)

2. Service Account Email

6. Once AISPM validates the credentials and permissions, the onboarding process is complete.

3. Validation and Scanning: Cortex establishes the API connection and validates the credentials and permissions. Cortex immediately begins to scan your onboarded agentic platform after a successful validation. The amount of time Cortex takes to scan varies based on the amount of data it is required to scan. At a minimum, it takes at least one hour to scan and display data in the AISPM dashboard.

Show markdown source

@@ -1,36 +0,0 @@
----
-description: >-
-  Onboard Gemini Enterprise to Cortex XSIAM SaaS AI Agent Security for
-  visibility and control.
----
-
-# Onboard Gemini Enterprise
-
-Gemini allows employees to use pre-built agents or create their own custom agents to perform tasks, analyze data, and automate workflows by securely connecting to company data and applications like Google Workspace and Salesforce. The platform aims to shift employees from tedious tasks to high-impact work while providing central governance and security.
-
-To access your Gemini Enterprise instance, AISPM requires the following specific information during the configuration process:
-
-| Item                  | Description                                                                                                                                                                                                                                                                                                                                                                                                  |
-| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Service Account Email | A service account email in Gemini Enterprise is a special non-human account. Applications and virtual machines use this account to authenticate and access Google Cloud resources securely. It provides a secure identity for programmatic access to the Gemini for Google Cloud API and related services.                                                                                                   |
-| Project ID            | A Project ID in Gemini Enterprise is a unique identifier for a Google Cloud project. Gemini Enterprise uses the Google Cloud platform, so its services and resources are organized within the same project structure. A Project ID is needed for authentication, billing, and access control when working with Gemini models and related services.                                                           |
-| Location              | <p>In Google Cloud's Gemini Enterprise, a "location" is a specific geographic area for creating, processing, and storing data. Location selection allows enterprises to control data residency. This control is important for data privacy, compliance, and meeting requirements in different regions.</p><p>Note: New locations created by Gemini Enterprise will be added by AISPM in a phased manner.</p> |
-
-1. Configure Google Cloud Console.
-   1. Go to your project home page (where you developed your agent) in the Google Cloud console. Copy your project ID and project number and keep it handy for onboarding later.
-   2. From the Google Cloud console, select Menu > APIs & Services > Enabled APIs & Services > +Enable APIs and services.
-   3. To create a new service account, select Menu > IAM & Admin > Service Accounts > +Create service account.
-   4. In the list of service accounts, click on the service account that you just created. The service account details are displayed. Copy the service account email address and keep it handy for onboarding later.
-   5. Select Principals with access > View by principals > Grant access.
-   6. In the Add principals section, specify the name of the principal.
-   7. In the Assign roles section, select the Service Account Token Creator role and click Save.
-2. Onboard Platform to AISPM
-   1. Log in to Cortex.
-   2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the Gemini Enterprise connector.
-   3. Click on the Gemini Enterprise tile and select Add Another Instance.
-   4. On the Capabilities page, provide an Instance Name and select Agent Security scanning capability.
-   5. On the Connections page enter the following information that you gathered in Step 1:
-      1. Project ID (You can use either the project ID or the project number.)
-      2. Service Account Email
-   6. Once AISPM validates the credentials and permissions, the onboarding process is complete.
-3. Validation and Scanning: Cortex establishes the API connection and validates the credentials and permissions. Cortex immediately begins to scan your onboarded agentic platform after a successful validation. The amount of time Cortex takes to scan varies based on the amount of data it is required to scan. At a minimum, it takes at least one hour to scan and display data in the AISPM dashboard.

▸ Onboard M365 Copilot deleted +0 −77

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-m365-copilot

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,77 +0,0 @@

---

description: >-

Onboard M365 Copilot to Cortex XSIAM SaaS AI Agent Security for visibility and

control.

---

# Onboard M365 Copilot

Microsoft 365 Copilot is an AI-powered assistant integrated into Word, Excel, PowerPoint, Outlook, Teams, and other Microsoft 365 apps. It uses Large Language Models (LLMs) and your organization's data to help with tasks like drafting content, analyzing data, summarizing meetings, and generating ideas. It acts as a "copilot" by streamlining workflows, boosting creativity, and increasing productivity by turning natural language prompts into actions and insights within your familiar work environment.

Prerequisites

• To access M365 Copilot and start building custom agents, your organization must have a Microsoft 365 Copilot license. If you would like to explore these capabilities, coordinate with your IT Administrator or Microsoft Sales representative to ensure the proper licensing is in place.

Note: M365 Copilot is a Microsoft-native product, not a feature developed or managed by Palo Alto Networks.

• To manage Microsoft 365 Copilot agents and settings, your account must be assigned a specific administrative role. You can verify your current access level by viewing the agent list. While a Global Administrator has full control over the entire organization, Microsoft recommends using the AI Administrator role. This is a dedicated persona designed specifically for managing Copilot features and agent governance without granting unnecessary access to other parts of your system. If you only need to monitor the environment, the Global Reader role provides "view-only" access, allowing you to see agent status and availability without the ability to make changes or upload new packages. Consult your internal IT team to ensure one of these roles is assigned to your account and you list agents via the URL mentioned above.

• In the Setting tab, select Active for assignment type and Permanently assigned for assignment duration. Add a justification for your settings and Assign.

1. Configure OATH Token Authentication Methods in Microsoft

To ensure a standardized login experience and support automated data extraction, configure Microsoft Entra ID to use Open Authentication (OATH) Time-based One-Time Password (TOTP) methods for the dedicated administrative account.

Note: To avoid a misconfiguration, ensure that you complete the following steps EXACTLY in the sequence provided. Deviating from this order can lead to authentication errors or service disruption.

Part A: Extract the Secret Key

1. During the multi-factor authentication (MFA) setup for your service/admin account on the Scan the QR code page, select the Can't scan QR code? link.

2. Record the Account name and the Secret key.

3. Store the secret key in a secure location, such as a password manager, for later use during onboarding or recovery (this acts as your TOTP Secret).

4. Click Next.

Part B: Verify the Token

5. Enter the secret key into your preferred OATH-compliant application (e.g., Google Authenticator, Authy, or a hardware token).

6. Click Next in the Microsoft portal.

7. Enter the 6-digit verification code generated by your application to verify the sync.

8. Click Next and then click Done to complete the initial token setup.

Part C: Register the Microsoft Authenticator App

Prerequisite: Ensure you have the Microsoft Authenticator app installed on your mobile device.

9. Log in to your account's security overview portal. If the setup screen does not appear automatically, proceed to the following sub-steps:

10. Navigate to Security Info: Select your profile icon in the top-right corner and click View Account. You will be redirected to the mysignins.microsoft.com/security-info page (or you can navigate to the Security Info page from the left navigation section).

11. Access Sign-in Methods: In the left navigation pane, select Security Info.

12. Click + Add sign-in method. From the drop-down menu, select Microsoft Authenticator app and click Add.

13. Initialize App Setup: When the Start by getting the app screen appears, click Next. On the Set up your account in app screen, click Next again to reveal the setup QR code.

14. Scan the QR Code: Open the Microsoft Authenticator app on your mobile device, add a new account, and scan the QR code displayed on your computer screen. Once scanned, click Next.

15. Verify the Connection: The portal will display a two-digit number. Enter this number into the prompt on your mobile device to complete the test notification.

16. Finalize Registration: Once the Notification approved message appears, click Next, then click Done.

17. Verification: Confirm that Microsoft Authenticator now appears in your list of registered Sign-in methods.

Part D: Confirm the Default Sign-in Method

16. Return to the Microsoft Entra admin center and select Users > Authentication methods.

17. Verify that the Software OATH token is listed under the authentication records.

18. Select Add authentication method or Change default manual method (if available) to ensure that the Third-party software OATH token option is configured as the primary requirement for compliance.

2. Onboard M365 Copilot to AISPM

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the Microsoft 365 Copilot connector.

3. Click on the Microsoft 365 Copilot tile and select Add Another Instance.

4. On the Capabilities page, provide an Instance Name and select Agent Security scanning capability.

5. On the Connections page, provide your Instance URL.

6. Under Authentication, the CREDENTIALS authentication method is selected by default. Click Next.

7. On the Onboard Agent Platform page, enter your admin account credentials and provide the Secret Key (OATH TOTP Secret) you recorded during Step 1.

8. Once Cortex validates the credentials and permissions, the onboarding process is complete.

3. Validation and Scanning:

Cortex immediately establishes a secure backend connection and validates the extracted credentials, administrative scopes, and OATH sync configurations. After validation succeeds, a confirmation window will appear.

Cortex immediately begins to parse and scan your onboarded agentic platform environment. The amount of time required to crawl varies based on your tenant's data volume. At a minimum, expect at least one hour to populate telemetry maps, permissions vectors, and security trends within the AISPM dashboard.

Show markdown source

@@ -1,77 +0,0 @@
----
-description: >-
-  Onboard M365 Copilot to Cortex XSIAM SaaS AI Agent Security for visibility and
-  control.
----
-
-# Onboard M365 Copilot
-
-Microsoft 365 Copilot is an AI-powered assistant integrated into Word, Excel, PowerPoint, Outlook, Teams, and other Microsoft 365 apps. It uses Large Language Models (LLMs) and your organization's data to help with tasks like drafting content, analyzing data, summarizing meetings, and generating ideas. It acts as a "copilot" by streamlining workflows, boosting creativity, and increasing productivity by turning natural language prompts into actions and insights within your familiar work environment.
-
-**Prerequisites**
-
-* To access M365 Copilot and start building custom agents, your organization must have a Microsoft 365 Copilot license. If you would like to explore these capabilities, coordinate with your IT Administrator or Microsoft Sales representative to ensure the proper licensing is in place.
-
-**Note**: M365 Copilot is a Microsoft-native product, not a feature developed or managed by Palo Alto Networks.
-
-* To manage Microsoft 365 Copilot agents and settings, your account must be assigned a specific administrative role. You can verify your current access level by viewing the agent list. While a Global Administrator has full control over the entire organization, Microsoft recommends using the AI Administrator role. This is a dedicated persona designed specifically for managing Copilot features and agent governance without granting unnecessary access to other parts of your system. If you only need to monitor the environment, the Global Reader role provides "view-only" access, allowing you to see agent status and availability without the ability to make changes or upload new packages. Consult your internal IT team to ensure one of these roles is assigned to your account and you list agents via the URL mentioned above.
-* In the Setting tab, select Active for assignment type and Permanently assigned for assignment duration. Add a justification for your settings and Assign.
-
-1. Configure OATH Token Authentication Methods in Microsoft
-
-To ensure a standardized login experience and support automated data extraction, configure Microsoft Entra ID to use Open Authentication (OATH) Time-based One-Time Password (TOTP) methods for the dedicated administrative account.
-
-Note: To avoid a misconfiguration, ensure that you complete the following steps EXACTLY in the sequence provided. Deviating from this order can lead to authentication errors or service disruption.
-
-**Part A: Extract the Secret Key**
-
-1. During the multi-factor authentication (MFA) setup for your service/admin account on the Scan the QR code page, select the Can't scan QR code? link.
-2. Record the Account name and the Secret key.
-3. Store the secret key in a secure location, such as a password manager, for later use during onboarding or recovery (this acts as your TOTP Secret).
-4. Click Next.
-
-**Part B: Verify the Token**
-
-5. Enter the secret key into your preferred OATH-compliant application (e.g., Google Authenticator, Authy, or a hardware token).
-6. Click Next in the Microsoft portal.
-7. Enter the 6-digit verification code generated by your application to verify the sync.
-8. Click Next and then click Done to complete the initial token setup.
-
-**Part C: Register the Microsoft Authenticator App**
-
-Prerequisite: Ensure you have the Microsoft Authenticator app installed on your mobile device.
-
-9. Log in to your account's security overview portal. If the setup screen does not appear automatically, proceed to the following sub-steps:
-10. Navigate to Security Info: Select your profile icon in the top-right corner and click View Account. You will be redirected to the mysignins.microsoft.com/security-info page (or you can navigate to the Security Info page from the left navigation section).
-11. Access Sign-in Methods: In the left navigation pane, select Security Info.
-12. Click + Add sign-in method. From the drop-down menu, select Microsoft Authenticator app and click Add.
-13. Initialize App Setup: When the Start by getting the app screen appears, click Next. On the Set up your account in app screen, click Next again to reveal the setup QR code.
-14. Scan the QR Code: Open the Microsoft Authenticator app on your mobile device, add a new account, and scan the QR code displayed on your computer screen. Once scanned, click Next.
-15. Verify the Connection: The portal will display a two-digit number. Enter this number into the prompt on your mobile device to complete the test notification.
-16. Finalize Registration: Once the Notification approved message appears, click Next, then click Done.
-17. Verification: Confirm that Microsoft Authenticator now appears in your list of registered Sign-in methods.
-
-**Part D: Confirm the Default Sign-in Method**
-
-16. Return to the Microsoft Entra admin center and select Users > Authentication methods.
-17. Verify that the Software OATH token is listed under the authentication records.
-18. Select Add authentication method or Change default manual method (if available) to ensure that the Third-party software OATH token option is configured as the primary requirement for compliance.
-
-2\. Onboard M365 Copilot to AISPM
-
-1. Log in to Cortex.
-2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the Microsoft 365 Copilot connector.
-3. Click on the Microsoft 365 Copilot tile and select Add Another Instance.
-4. On the **Capabilities** page, provide an Instance Name and select Agent Security scanning capability.
-5. On the **Connections** page, provide your Instance URL.
-6. Under Authentication, the CREDENTIALS authentication method is selected by default. Click Next.
-7. On the Onboard Agent Platform page, enter your admin account credentials and provide the Secret Key (OATH TOTP Secret) you recorded during Step 1.
-8. Once Cortex validates the credentials and permissions, the onboarding process is complete.
-
-3\. Validation and Scanning:
-
-Cortex immediately establishes a secure backend connection and validates the extracted credentials, administrative scopes, and OATH sync configurations. After validation succeeds, a confirmation window will appear.
-
-Cortex immediately begins to parse and scan your onboarded agentic platform environment. The amount of time required to crawl varies based on your tenant's data volume. At a minimum, expect at least one hour to populate telemetry maps, permissions vectors, and security trends within the AISPM dashboard.
-
-<br>

▸ Onboard Microsoft Copilot Studio deleted +0 −74

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-microsoft-copilot-studio

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,74 +0,0 @@

---

description: >-

Onboard Microsoft Copilot Studio to Cortex XSIAM SaaS AI Agent Security for

visibility and control.

---

# Onboard Microsoft Copilot Studio

Prerequisites

• Licensing: To access Microsoft Copilot Studio and start building custom agents, your organization must have an active Microsoft Copilot Studio license. Coordinate with your IT Administrator or Microsoft Sales representative to ensure the proper licensing is in place. Note: Copilot Studio is a Microsoft-native product, not a feature developed or managed by Palo Alto Networks.

• Azure Permissions: Ensure you have Administrative privileges in the Microsoft Azure portal to register apps and grant API permissions. To perform onboarding, you must have an Application Administrator role. This role manages application settings and permissions within Microsoft Entra ID (Azure AD) and has the ability to restart provisioning of an enterprise application.

• Power Platform Permissions: Ensure you have a System Administrator or Power Platform Administrator role to add app users to the relevant environment.

• Environment Settings: Ensure you disable Administration mode in the Power Platform Admin Center.

1. Configure Permissions in Microsoft Azure.

Create an app registration in your Microsoft Azure Portal to grant Palo Alto Networks® secure, read-only access to your Microsoft Copilot Studio environment.

1. Register a new app in Microsoft Azure

1. Log in to the Microsoft Azure Portal.

2. Navigate to or search for App registrations.

3. Click + New Registration.

4. Enter a descriptive Name for the app (for example: PaloAltoNetworks_Agent_Security_Connector).

5. Click Register.

2. Configure API permissions for the new app

1. From the new app details page, select Manage > API permissions.

2. Click + Add a permission and select Application permissions under Microsoft Graph.

3. Add the following Microsoft Graph permissions:

1. Application.Read.All

2. AuditLog.Read.All

3. AuditLogsQuery-CRM.Read.All

4. AuditLogsQuery.Read.All

4. Click Add permissions to save the app API permissions.

5. Grant Admin Consent: The permissions you added require admin consent. On the Configured permissions page, click Grant admin consent for <your-organization>.

6. In the confirmation pop-up, select Yes to grant admin consent for your organization.

3. Create a Client Secret for the new app

1. From the new app details page, select Manage > Certificates & secrets.

2. Click + New client secret.

3. Enter a description (for example: SaaS_Security_Key) and select an expiration period.

4. Click Add.

5. CRITICAL: Copy the Client Secret Value immediately and store it in a secure location. This value will be hidden permanently once you leave the page.

6. Grant the app access in the Microsoft Power Platform admin center

4. Log in to the Microsoft Power Platform Admin Center.

1. Select Manage > Environments and click on your target Copilot Studio environment.

2. Navigate to Settings > Users + permissions > Application users and click + New app user.

3. Click + Add an app and search for the application registration you created in Step 1.

4. Select the correct Business unit from the drop-down menu.

5. Click the pencil icon next to Security roles, assign the Service Reader role, and click Save.

6. Click Create to finalize the app access privileges.

5. Gather the required configuration values

1. Before moving to the next step, ensure you have gathered and copied the following variables:

1. Environment URL: Found on the environment's main page in the Microsoft Power Platform Admin Center.

2. Application (Client) ID: Displayed in the app Overview tab in the Microsoft Azure Portal.

3. Directory (Tenant) ID: Displayed in the app Overview tab in the Microsoft Azure Portal.

4. Client Secret Value: The secret value you securely stored in Step 3.

6. Onboard Microsoft Copilot Studio to AISPM. Establish the API connection between the Palo Alto Networks platform and your Microsoft Copilot Studio environment using the gathered credentials.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the Microsoft Copilot Studio connector.

3. Click on the Microsoft Copilot Studio tile and select Add Another Instance.

1. On the Capabilities page, provide an Instance Name and select Agent Security scanning capability.

4. On the Connections page, provide your Instance URL and select an authentication method. Input the following:

1. Tenant ID

1. Power Platform Environment URL

5. Under Agent Security Scanning, provide the Client ID and Client Secret.

6. Once AISPM validates the credentials and permissions, the onboarding process is complete.

7. Validation and Scanning: Cortex will process the credentials and notify you once onboarding is complete. The amount of time required to complete the scan varies depending on your tenant's total volume of data. At a minimum, expect it to take at least one hour to process logs and display security telemetry inside the AISPM dashboard.

### Troubleshooting Potential Onboarding Failures

If Microsoft Copilot Studio fails to onboard, AISPM will flag one of the following error states:

• Permission Errors during Scan: Verify you entered all credentials correctly and double-check that you successfully executed the Grant Admin Consent step when configuring your Azure API Permissions.

• Connection Test Fails: Confirm that you assigned the Service Reader role to the application user inside the Power Platform Admin Center.

Show markdown source

@@ -1,74 +0,0 @@
----
-description: >-
-  Onboard Microsoft Copilot Studio to Cortex XSIAM SaaS AI Agent Security for
-  visibility and control.
----
-
-# Onboard Microsoft Copilot Studio
-
-**Prerequisites**
-
-* Licensing: To access Microsoft Copilot Studio and start building custom agents, your organization must have an active Microsoft Copilot Studio license. Coordinate with your IT Administrator or Microsoft Sales representative to ensure the proper licensing is in place. Note: Copilot Studio is a Microsoft-native product, not a feature developed or managed by Palo Alto Networks.
-* Azure Permissions: Ensure you have Administrative privileges in the Microsoft Azure portal to register apps and grant API permissions. To perform onboarding, you must have an Application Administrator role. This role manages application settings and permissions within Microsoft Entra ID (Azure AD) and has the ability to restart provisioning of an enterprise application.
-* Power Platform Permissions: Ensure you have a System Administrator or Power Platform Administrator role to add app users to the relevant environment.
-* Environment Settings: Ensure you disable Administration mode in the Power Platform Admin Center.
-
-1. Configure Permissions in Microsoft Azure.
-
-Create an app registration in your Microsoft Azure Portal to grant Palo Alto Networks® secure, read-only access to your Microsoft Copilot Studio environment.
-
-1. Register a new app in Microsoft Azure
-   1. Log in to the Microsoft Azure Portal.
-   2. Navigate to or search for App registrations.
-   3. Click + New Registration.
-   4. Enter a descriptive Name for the app (for example: PaloAltoNetworks\_Agent\_Security\_Connector).
-   5. Click Register.
-2. Configure API permissions for the new app
-   1. From the new app details page, select Manage > API permissions.
-   2. Click + Add a permission and select Application permissions under Microsoft Graph.
-   3. Add the following Microsoft Graph permissions:
-      1. Application.Read.All
-      2. AuditLog.Read.All
-      3. AuditLogsQuery-CRM.Read.All
-      4. AuditLogsQuery.Read.All
-   4. Click Add permissions to save the app API permissions.
-   5. Grant Admin Consent: The permissions you added require admin consent. On the Configured permissions page, click Grant admin consent for \<your-organization>.
-   6. In the confirmation pop-up, select Yes to grant admin consent for your organization.
-3. Create a Client Secret for the new app
-   1. From the new app details page, select Manage > Certificates & secrets.
-   2. Click + New client secret.
-   3. Enter a description (for example: SaaS\_Security\_Key) and select an expiration period.
-   4. Click Add.
-   5. CRITICAL: Copy the Client Secret Value immediately and store it in a secure location. This value will be hidden permanently once you leave the page.
-   6. Grant the app access in the Microsoft Power Platform admin center
-4. Log in to the Microsoft Power Platform Admin Center.
-   1. Select Manage > Environments and click on your target Copilot Studio environment.
-   2. Navigate to Settings > Users + permissions > Application users and click + New app user.
-   3. Click + Add an app and search for the application registration you created in Step 1.
-   4. Select the correct Business unit from the drop-down menu.
-   5. Click the pencil icon next to Security roles, assign the Service Reader role, and click Save.
-   6. Click Create to finalize the app access privileges.
-5. Gather the required configuration values
-   1. Before moving to the next step, ensure you have gathered and copied the following variables:
-      1. Environment URL: Found on the environment's main page in the Microsoft Power Platform Admin Center.
-      2. Application (Client) ID: Displayed in the app Overview tab in the Microsoft Azure Portal.
-      3. Directory (Tenant) ID: Displayed in the app Overview tab in the Microsoft Azure Portal.
-      4. Client Secret Value: The secret value you securely stored in Step 3.
-6. Onboard Microsoft Copilot Studio to AISPM. Establish the API connection between the Palo Alto Networks platform and your Microsoft Copilot Studio environment using the gathered credentials.
-   1. Log in to Cortex.
-   2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the Microsoft Copilot Studio connector.
-   3. Click on the Microsoft Copilot Studio tile and select **Add Another Instance**.
-      1. On the **Capabilities** page, provide an Instance Name and select Agent Security scanning capability.
-   4. On the **Connections** page, provide your Instance URL and select an authentication method. Input the following:
-      1. Tenant ID
-         1. Power Platform Environment URL
-   5. Under **Agent Security Scanning**, provide the Client ID and Client Secret.
-   6. Once AISPM validates the credentials and permissions, the onboarding process is complete.
-7. Validation and Scanning: Cortex will process the credentials and notify you once onboarding is complete. The amount of time required to complete the scan varies depending on your tenant's total volume of data. At a minimum, expect it to take at least one hour to process logs and display security telemetry inside the AISPM dashboard.
-
-### Troubleshooting Potential Onboarding Failures
-
-If Microsoft Copilot Studio fails to onboard, AISPM will flag one of the following error states:
-
-* Permission Errors during Scan: Verify you entered all credentials correctly and double-check that you successfully executed the Grant Admin Consent step when configuring your Azure API Permissions.
-* Connection Test Fails: Confirm that you assigned the Service Reader role to the application user inside the Power Platform Admin Center.

▸ Onboard Service Now deleted +0 −64

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-service-now

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,64 +0,0 @@

---

description: >-

Onboard ServiceNow to Cortex XSIAM SaaS AI Agent Security for visibility and

control.

---

# Onboard Service Now

To secure access to your ServiceNow data and successfully onboard to Cortex, you must complete two main phases:

1. Create an application registry that the platform will use to access your ServiceNow data via the REST API. The configuration consists of creating a user, creating an authentication scope, and using them to create an application registry.

2. Onboard the ServiceNow platform to AISPM via Strata Cloud Manager.

Prerequisites: Ensure you have the necessary administrative privileges in your ServiceNow instance, including the ability to elevate your role to security_admin to create and manage Access Control Lists (ACLs).

### Create an Application Registry

1. Create a Service User\

Note: Ensure you elevate your role to security_admin before creating the user and grant read-only access to the required tables using Access Control Lists (ACLs). You could also edit existing roles.

1. Sign in to your ServiceNow instance.

2. In the search box, start typing and select User Administration > Users > New and enter the following details:

1. User ID

2. First name and Last name

3. Email

3. Select the Web service access only check box. (Note: This is critical as it ensures the user cannot be used for interactive sign-in.)

4. Select the Active check box and Submit the new user record.

5. Select a role for the new user:

• The role must have read and write permission to the sys_gen_ai_skill_applicability table.

• For all other tables, only read permission is required.

• If necessary, you can create a custom role in ServiceNow with these specific permissions. The read permission will enable AISPM to scan the ServiceNow AI Platform for agent risks. The write permission to the applicability table will enable you to remediate risky plugins and take agents offline.

2. Create the Authentication Scope\

Note: Before creating the OAuth 2.0 integration, create a scope that limits AISPM's access to only the Table API.

1. Navigate to the Authentication Scopes table (sys_auth_scope.list) by using the filter navigator.

2. Click New to define the authentication scope.

3. Specify a meaningful Name for your authentication scope, such as SaaS_Agent_Security_Scope or SSPM Agentic Scope.

4. (Optional) Specify a Description. Click Submit.

    Note: Keep the authentication scope name handy, as it is required when configuring the REST API Auth Scope and OAuth 2.0 integration.

3. Create the Application Registry (OAuth Client)\

Standard Release Instructions:

1. Log in to ServiceNow as an administrator.

2. Navigate to the Application Registries page (System OAuth > Application Registry).

3. Select New > Create an OAuth API endpoint for external clients.

4. Copy the auto-generated Client ID and Client Secret and keep them handy.

5. Ensure the following additional details are filled in correctly:

6. Set the Application to Global.

7. Ensure it's accessible from all application scopes.

8. Ensure the Active check box is selected.

9. OAuth Application User: Enter the user you created in Step 1.

10. Default grant type: Choose Client Credentials. (Ensure that the system property glide.oauth.inbound.client.credential.grant_type.enabled is set to true).

11. Specify your OAuth Scope that you created in Step 2.

12. Click Submit.

4. Onboard ServiceNow Platform to Cortex.

1. Log in to Cortex.

2. Select Settings > Data Sources and Integrations > Add New. You can use the Search bar to find the ServiceNow connector.

3. Click on the ServiceNow tile and select Add Another Instance.

4. On the Capabilities page, provide an Instance Name and select Agent Security scanning capability.

5. On the Connections page, provide your Instance URL and select an authentication method. Enter the information you gathered (Client ID, Client Secret, etc.) during Step 1 in the corresponding fields.

6. Once AISPM validates the credentials and permissions, the onboarding process is complete.

#### Troubleshooting

If you see errors after onboarding, this is likely due to incomplete permissions. Return to the application registry creation procedure and verify that the assigned role possesses a read-only ACL rule for every single required table. Also, ensure that this role is correctly assigned to the service user you created.

Show markdown source

@@ -1,64 +0,0 @@
----
-description: >-
-  Onboard ServiceNow to Cortex XSIAM SaaS AI Agent Security for visibility and
-  control.
----
-
-# Onboard Service Now
-
-To secure access to your ServiceNow data and successfully onboard to Cortex, you must complete two main phases:
-
-1. Create an application registry that the platform will use to access your ServiceNow data via the REST API. The configuration consists of creating a user, creating an authentication scope, and using them to create an application registry.
-2. Onboard the ServiceNow platform to AISPM via Strata Cloud Manager.
-
-**Prerequisites**: Ensure you have the necessary administrative privileges in your ServiceNow instance, including the ability to elevate your role to security\_admin to create and manage Access Control Lists (ACLs).
-
-### Create an Application Registry
-
-1. Create a Service User\
-   Note: Ensure you elevate your role to security\_admin before creating the user and grant read-only access to the required tables using Access Control Lists (ACLs). You could also edit existing roles.
-   1. Sign in to your ServiceNow instance.
-   2. In the search box, start typing and select User Administration > Users > New and enter the following details:
-      1. User ID
-      2. First name and Last name
-      3. Email
-   3. Select the Web service access only check box. (Note: This is critical as it ensures the user cannot be used for interactive sign-in.)
-   4. Select the Active check box and Submit the new user record.
-   5. Select a role for the new user:
-      * The role must have read and write permission to the sys\_gen\_ai\_skill\_applicability table.
-      * For all other tables, only read permission is required.
-      * If necessary, you can create a custom role in ServiceNow with these specific permissions. The read permission will enable AISPM to scan the ServiceNow AI Platform for agent risks. The write permission to the applicability table will enable you to remediate risky plugins and take agents offline.
-2.  Create the Authentication Scope\
-    Note: Before creating the OAuth 2.0 integration, create a scope that limits AISPM's access to only the Table API.
-
-    1. Navigate to the Authentication Scopes table (sys\_auth\_scope.list) by using the filter navigator.
-    2. Click New to define the authentication scope.
-    3. Specify a meaningful Name for your authentication scope, such as SaaS\_Agent\_Security\_Scope or SSPM Agentic Scope.
-    4. (Optional) Specify a Description. Click Submit.
-
-    Note: Keep the authentication scope name handy, as it is required when configuring the REST API Auth Scope and OAuth 2.0 integration.
-3. Create the Application Registry (OAuth Client)\
-   Standard Release Instructions:
-   1. Log in to ServiceNow as an administrator.
-   2. Navigate to the Application Registries page (System OAuth > Application Registry).
-   3. Select New > Create an OAuth API endpoint for external clients.
-   4. Copy the auto-generated Client ID and Client Secret and keep them handy.
-   5. Ensure the following additional details are filled in correctly:
-   6. Set the Application to Global.
-   7. Ensure it's accessible from all application scopes.
-   8. Ensure the Active check box is selected.
-   9. OAuth Application User: Enter the user you created in Step 1.
-   10. Default grant type: Choose Client Credentials. (Ensure that the system property glide.oauth.inbound.client.credential.grant\_type.enabled is set to true).
-   11. Specify your OAuth Scope that you created in Step 2.
-   12. Click Submit.
-4. Onboard ServiceNow Platform to Cortex.
-   1. Log in to Cortex.
-   2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the ServiceNow connector.
-   3. Click on the ServiceNow tile and select Add Another Instance.
-   4. On the **Capabilities** page, provide an Instance Name and select Agent Security scanning capability.
-   5. On the **Connections** page, provide your Instance URL and select an authentication method. Enter the information you gathered (Client ID, Client Secret, etc.) during Step 1 in the corresponding fields.
-   6. Once AISPM validates the credentials and permissions, the onboarding process is complete.
-
-#### Troubleshooting
-
-If you see errors after onboarding, this is likely due to incomplete permissions. Return to the application registry creation procedure and verify that the assigned role possesses a read-only ACL rule for every single required table. Also, ensure that this role is correctly assigned to the service user you created.

▸ Setup SaaS Security for AISPM deleted +0 −15

xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-ai-agent-security/setup-saas-security-for-aispm

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,15 +0,0 @@

---

description: >-

Set up Cortex XSIAM SaaS AI Agent Security to discover and secure SaaS AI

agents.

---

# Setup SaaS Security for AISPM

Learn more about how SaaS security can help your security team reliably manage usage policies, close visibility gaps, and secure sensitive data housed across your entire cloud portfolio.

Take Action│Start Here

| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Get Started with AISPM│

Required Cortex License: SaaS Security requires one of the following Cortex Licenses:
Enable Access: Ensure that you have whitelisted the required IPs to ensure optimal onboarding and connectivity.

Onboard SaaS Agents│

Administration│

Manage SaaS AI Agents

Show markdown source

@@ -1,15 +0,0 @@
----
-description: >-
-  Set up Cortex XSIAM SaaS AI Agent Security to discover and secure SaaS AI
-  agents.
----
-
-# Setup SaaS Security for AISPM
-
-Learn more about how SaaS security can help your security team reliably manage usage policies, close visibility gaps, and secure sensitive data housed across your entire cloud portfolio.
-
-| Take Action            | Start Here                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Get Started with AISPM | <ul><li><p>Required Cortex License: SaaS Security requires one of the following Cortex Licenses:</p><ul><li><a href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-3.x-Documentation/Cortex-XSIAM-product-licenses">Cortex XSIAM</a></li><li><a href="https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Runtime-Security-Documentation/Understand-license-plans">Cortex Runtime Security</a></li><li><a href="https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Posture-Management-Documentation/Understand-license-plans">Cortex Posture Security</a></li></ul></li><li><a href="../../../../onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources">Enable Access</a>: Ensure that you have whitelisted the required IPs to ensure optimal onboarding and connectivity.</li></ul> |
-| Onboard SaaS Agents    | <ul><li><a href="broken-reference">Atlassian Rovo</a></li><li><a href="broken-reference">Box AI Agents</a></li><li><a href="broken-reference">ChatGPT Enterprise</a></li><li><a href="broken-reference">Cursor Enterprise</a></li><li><a href="broken-reference">Gemini Enterprise</a></li><li><a href="broken-reference">Microsoft 365 Copilot</a></li><li><a href="broken-reference">Microsoft Copilot Studio</a></li><li><a href="broken-reference">ServiceNow AI Platform</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Administration         | <ul><li><p><a href="broken-reference">Manage SaaS AI Agents</a></p><ul><li><a href="broken-reference">View AI Agents</a></li><li><a href="broken-reference">View Datasets</a></li><li><a href="broken-reference">View Agent Tools</a></li><li><a href="broken-reference">Remediation Actions</a></li></ul></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |

▸ SaaS Security Checks deleted +0 −20 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-security-checks

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,20 +0,0 @@

---

description: >-

Use Cortex XSIAM SaaS Security Checks to identify SaaS assets at risk and

prioritize remediation.

---

# SaaS Security Checks

SaaS Security Checks provides security telemetry for posture misconfigurations, vulnerabilities, and compliance in one unified view. This consolidated dashboard provides a queryable, prioritized view of your attack surface, accelerating automated triage, incident response, and compliance auditing.

The dashboard captures the following key metrics to help you remediate assets at risk:

• SaaS Security Check Score: Renders the current, aggregate security posture score as a normalized percentage, while also tracking score volatility over a rolling 90-day window to monitor long-term posture drift.

• Overall Compliance: Monitors adherence to mapped compliance standards and frameworks.

• Provider Instances by Security Check Score: Categorizes individual SaaS tenant configurations (such as Salesforce, Mural, or Google Workspace) to identify low-performing integrations, based on their security scores.

• Issues to Address: Acts as a prioritized vulnerability backlog, organizing discovered misconfigurations by severity to guide triage queues.

Optionally, you can also navigate to Module > SaaS > Security Checks > Posture to view a tabular list of Posture Issues filtered by SaaS Issues. Select any Issue to view a full list of Remediation Actions. Here you can also view the Evidence section, that includes granular information about specific application settings that lead to misconfigurations.

Show markdown source

@@ -1,20 +0,0 @@
----
-description: >-
-  Use Cortex XSIAM SaaS Security Checks to identify SaaS assets at risk and
-  prioritize remediation.
----
-
-# SaaS Security Checks
-
-SaaS Security Checks provides security telemetry for posture misconfigurations, vulnerabilities, and compliance in one unified view. This consolidated dashboard provides a queryable, prioritized view of your attack surface, accelerating automated triage, incident response, and compliance auditing.
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FsTN50fsPyBbITq1HaqvK%2Funknown.png?alt=media&#x26;token=d3ff0626-c7d7-4232-8aec-c948bb6f5f3c" alt="" height="429" width="624">
-
-The dashboard captures the following key metrics to help you remediate assets at risk:
-
-* SaaS Security Check Score: Renders the current, aggregate security posture score as a normalized percentage, while also tracking score volatility over a rolling 90-day window to monitor long-term posture drift.
-* Overall Compliance: Monitors adherence to mapped compliance standards and frameworks.
-* Provider Instances by Security Check Score: Categorizes individual SaaS tenant configurations (such as Salesforce, Mural, or Google Workspace) to identify low-performing integrations, based on their security scores.
-* Issues to Address: Acts as a prioritized vulnerability backlog, organizing discovered misconfigurations by severity to guide triage queues.
-
-Optionally, you can also navigate to **Module > SaaS > Security Checks > Posture** to view a tabular list of Posture Issues filtered by SaaS Issues. Select any Issue to view a full list of **Remediation Actions**. Here you can also view the **Evidence** section, that includes granular information about specific application settings that lead to misconfigurations.

▸ SaaS Security Overview deleted +0 −31 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/saas-security-overview

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,31 +0,0 @@

---

description: >-

Use the Cortex XSIAM SaaS Security Overview to monitor posture, identity,

data, and AI agent security.

---

# SaaS Security Overview

The SaaS Overview dashboard provides unified visibility into your multi-SaaS security posture to streamline daily operations. The dashboard seamlessly aggregates and presents security data from all four core SaaS Security pillars including: SSPM (Posture), SaaS Identity Security, SaaS Data Security, and SaaS Agent Security. Leverage this view to:

• Triage Threats: Detect and investigate active security events in real time.

• Manage Posture: Surface and prioritize misconfigurations across connected applications and assets.

• Provide Executive Reporting: Track aggregate risk scores and compliance trends for stakeholder updates.

Review the descriptions below for a detailed breakdown of interactive widgets:

1. The application inventory header bar displays high-level statistics for monitored applications and assets along with state sync indicators. This high-level indicator provides you with a comprehensive view of all your SaaS applications and impacted assets.

2. The central interactive visual graph maps security domains to aggregated issues and severity classifications. This helps you gauge the overall health of your security operations and ensure that your team is maintaining a positive burn-down rate of vulnerabilities.

3. Domain Security Nodes: Hover over or click a domain node to highlight tracked vulnerability data, such as Agents with Sensitive Data, and view domain-specific asset inventories.

4. Summarizes Findings into two operational buckets:

• Active Threat Issues

• Posture Issues

5. Top Active Threats to Address: Displays a prioritized list of specific threat alerts to help you identify and investigate high-risk activities that could lead to a breach.

6. Top Posture Issues to Address: Lists the most critical configuration issues and vulnerabilities, categorized by asset type (Data, Identity, API) and the number of impacted assets, to help your team remediate the most widespread risks to your organization’s security posture.

7. Compliance Summary: Tracks compliance percentage across specific global standards, to help you report out regulatory readiness to stakeholders and prioritize efforts to close specific compliance gaps.

Show markdown source

@@ -1,31 +0,0 @@
----
-description: >-
-  Use the Cortex XSIAM SaaS Security Overview to monitor posture, identity,
-  data, and AI agent security.
----
-
-# SaaS Security Overview
-
-The SaaS Overview dashboard provides unified visibility into your multi-SaaS security posture to streamline daily operations. The dashboard seamlessly aggregates and presents security data from all four core SaaS Security pillars including: SSPM (Posture), SaaS Identity Security, SaaS Data Security, and SaaS Agent Security. Leverage this view to:
-
-* Triage Threats: Detect and investigate active security events in real time.
-* Manage Posture: Surface and prioritize misconfigurations across connected applications and assets.
-* Provide Executive Reporting: Track aggregate risk scores and compliance trends for stakeholder updates.
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FtsDAHRj1KQ8JtZHhcrcZ%2Funknown.png?alt=media&#x26;token=8098a3df-78d9-48c2-81e0-96229cf30af2" alt="" height="349" width="624">
-
-Review the descriptions below for a detailed breakdown of interactive widgets:
-
-1. The application inventory header bar displays high-level statistics for monitored applications and assets along with state sync indicators. This high-level indicator provides you with a comprehensive view of all your SaaS applications and impacted assets.
-2. The central interactive visual graph maps security domains to aggregated issues and severity classifications. This helps you gauge the overall health of your security operations and ensure that your team is maintaining a positive burn-down rate of vulnerabilities.
-3. Domain Security Nodes: Hover over or click a domain node to highlight tracked vulnerability data, such as Agents with Sensitive Data, and view domain-specific asset inventories.
-4. Summarizes Findings into two operational buckets:
-
-* Active Threat Issues
-* Posture Issues
-
-<img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FMOPqXOoD9uQ2WpgPWu6P%2Funknown.png?alt=media&#x26;token=ee8a72ef-832d-46b6-8134-3cba0859924e" alt="" height="392" width="624">
-
-5. Top Active Threats to Address: Displays a prioritized list of specific threat alerts to help you identify and investigate high-risk activities that could lead to a breach.
-6. Top Posture Issues to Address: Lists the most critical configuration issues and vulnerabilities, categorized by asset type (Data, Identity, API) and the number of impacted assets, to help your team remediate the most widespread risks to your organization’s security posture.
-7. Compliance Summary: Tracks compliance percentage across specific global standards, to help you report out regulatory readiness to stakeholders and prioritize efforts to close specific compliance gaps.

▸ Setup SaaS Security deleted +0 −15 xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/setup-saas-security

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,15 +0,0 @@

---

description: >-

Set up Cortex Cloud SaaS Security in Cortex XSIAM to monitor SaaS

applications, identities, and AI agents.

---

# Setup SaaS Security

Learn more about how SaaS security can help your security team reliably manage usage policies, close visibility gaps, and secure sensitive data housed across your entire cloud portfolio.

Get Started with SaaS Security│

Required Cortex License - SaaS Security requires one of the following Cortex Licenses:
Allow List of IP Addresses - Ensure that you have whitelisted the required IPs to ensure optimal onboarding and connectivity.

| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Configure SaaS Security│

*

Show markdown source

@@ -1,15 +0,0 @@
----
-description: >-
-  Set up Cortex Cloud SaaS Security in Cortex XSIAM to monitor SaaS
-  applications, identities, and AI agents.
----
-
-# Setup SaaS Security
-
-Learn more about how SaaS security can help your security team reliably manage usage policies, close visibility gaps, and secure sensitive data housed across your entire cloud portfolio.
-
-| Get Started with SaaS Security | <ul><li><p>Required Cortex License - SaaS Security requires one of the following Cortex Licenses:</p><ul><li><a href="../../../learn-about-cortex-xsiam/cortex-xsiam-product-licenses">Cortex XSIAM</a></li><li><a href="../../../learn-about-cortex-xsiam/cortex-xsiam-product-licenses">Cortex Runtime Security</a></li><li><a href="../../../learn-about-cortex-xsiam/cortex-xsiam-product-licenses">Cortex Posture Security</a></li></ul></li><li><a href="../../../onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources">Allow List of IP Addresses</a> - Ensure that you have whitelisted the required IPs to ensure optimal onboarding and connectivity.</li></ul> |
-| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Configure SaaS Security        | <ul><li><a href="onboard-a-supported-saas-application">Onboard a Supported SaaS Application</a></li><li><p><a href="">SaaS Security</a></p><ul><li><a href="saas-security-overview">SaaS Security Overview</a></li><li><a href="saas-security-checks">SaaS Security Checks</a></li><li><a href="provider-instances-security-check">Provider Instances Security Check</a></li><li><a href="remediation-actions">Remediation Actions</a></li><li><a href="detection-rules">Detection Rules</a></li><li><a href="create-and-monitor-tickets">Create and monitor tickets</a></li></ul></li></ul>                                                                                                                              |
-
-*

▸ How to perform advanced AI Security investigations using XQL modified +6 −6 xsiam/cloud-security/cortex-cloud-ai-security/how-to-perform-advanced-ai-security-investigations-using-xql

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,36 +1,36 @@

---

description: >-

Use XQL in Cortex XSIAM to investigate Cortex Cloud AI Security datasets and

Use XQL in Cortex XSIAM to investigate Cloud AI Security datasets and

findings.

---

# How to perform advanced AI Security investigations using XQL

hint info

This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

endhint

#### Overview

Cortex Cloud AI Security centralizes information about your AI ecosystem into a list of datasets, providing the foundation for comprehensive security investigations. Using Cortex Query Language (XQL) , security practitioners can create custom queries to extract valuable insights from these data sources within their appliance. For more information, see Get started with XQL.

Cloud AI Security centralizes information about your AI ecosystem into a list of datasets, providing the foundation for comprehensive security investigations. Using Cortex Query Language (XQL) , security practitioners can create custom queries to extract valuable insights from these data sources within their appliance. For more information, see Get started with XQL.

You can use the following AI-related datasets:

Dataset│Description

| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

asset_inventory│Provides a normalized, structured inventory of all digital assets across your AI environment, including detailed metadata for each asset, such as type, cloud provider, region, and security configurations. The dataset also maps relationships between assets, enabling the identification of complex AI and cloud dependencies for a comprehensive AI security posture.

classification_mgmt_data_profile│Provides administrative insights into the data classification policies and profiles configured within the Cortex Cloud Data Classification service.This dataset is primarily used for monitoring and managing the data classification rules in the Cortex Cloud environment.

findings│Contains the findings that are associated with the assets that are found in your environments. For more information, see Findings and events.

issues│Consolidates all AI security vulnerabilities, misconfigurations, and threats detected by Cortex Cloud AI Security. Each entry includes detailed context, such as the affected asset ID, a risk score, a description of the issue, and suggested remediation steps. This dataset provides a unified, actionable view of all security risks for your organization.

issues│Consolidates all AI security vulnerabilities, misconfigurations, and threats detected by Cloud AI Security. Each entry includes detailed context, such as the affected asset ID, a risk score, a description of the issue, and suggested remediation steps. This dataset provides a unified, actionable view of all security risks for your organization.

#### Investigate Cortex Cloud AI Security

#### Investigate Cloud AI Security in Cortex XSIAM

To run queries on your Cortex Cloud AI Security datasets:

To run queries on your Cloud AI Security datasets:

1. In Cortex Cloud, in the navigation pane on the left, click Investigation & Response, then under Search, click Query Builder.

2. Click XQL.

3. You can start typing your query in the box at the top of the screen, or search for existing queries on the Query Library tab.

4. Click Run. The results of the query appear on the Query Results tab.

hint info

### Note

Show markdown source

@@ -1,36 +1,36 @@
 ---
 description: >-
-  Use XQL in Cortex XSIAM to investigate Cortex Cloud AI Security datasets and
+  Use XQL in Cortex XSIAM to investigate Cloud AI Security datasets and
   findings.
 ---
 
 # How to perform advanced AI Security investigations using XQL
 
 {% hint style="info" %}
-This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
+Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
 {% endhint %}
 
 #### Overview
 
-Cortex Cloud AI Security centralizes information about your AI ecosystem into a list of datasets, providing the foundation for comprehensive security investigations. Using Cortex Query Language (XQL) , security practitioners can create custom queries to extract valuable insights from these data sources within their appliance. For more information, see [Get started with XQL](../../reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql).
+Cloud AI Security centralizes information about your AI ecosystem into a list of datasets, providing the foundation for comprehensive security investigations. Using Cortex Query Language (XQL) , security practitioners can create custom queries to extract valuable insights from these data sources within their appliance. For more information, see [Get started with XQL](../../reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql).
 
 You can use the following AI-related datasets:
 
 | Dataset                             | Description                                                                                                                                                                                                                                                                                                                                                                |
 | ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | asset\_inventory                    | Provides a normalized, structured inventory of all digital assets across your AI environment, including detailed metadata for each asset, such as type, cloud provider, region, and security configurations. The dataset also maps relationships between assets, enabling the identification of complex AI and cloud dependencies for a comprehensive AI security posture. |
 | classification\_mgmt\_data\_profile | Provides administrative insights into the data classification policies and profiles configured within the Cortex Cloud Data Classification service.This dataset is primarily used for monitoring and managing the data classification rules in the Cortex Cloud environment.                                                                                               |
 | findings                            | Contains the findings that are associated with the assets that are found in your environments. For more information, see [Findings and events](../../../detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/issues-findings-and-events#findings-and-events).                                                                                |
-| issues                              | Consolidates all AI security vulnerabilities, misconfigurations, and threats detected by Cortex Cloud AI Security. Each entry includes detailed context, such as the affected asset ID, a risk score, a description of the issue, and suggested remediation steps. This dataset provides a unified, actionable view of all security risks for your organization.           |
+| issues                              | Consolidates all AI security vulnerabilities, misconfigurations, and threats detected by Cloud AI Security. Each entry includes detailed context, such as the affected asset ID, a risk score, a description of the issue, and suggested remediation steps. This dataset provides a unified, actionable view of all security risks for your organization.                  |
 
-#### Investigate Cortex Cloud AI Security
+#### Investigate Cloud AI Security in Cortex XSIAM
 
-To run queries on your Cortex Cloud AI Security datasets:
+To run queries on your Cloud AI Security datasets:
 
 1. In Cortex Cloud, in the navigation pane on the left, click **Investigation & Response**, then under **Search**, click **Query Builder**.
 2. Click **XQL**.
 3. You can start typing your query in the box at the top of the screen, or search for existing queries on the **Query Library** tab.
 4. Click **Run**. The results of the query appear on the **Query Results** tab.
 
 {% hint style="info" %}
 ### Note

▸ Supported services in Cortex Cloud AI Security modified +3 −7 xsiam/cloud-security/cortex-cloud-ai-security/supported-services-in-cortex-cloud-ai-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,26 +1,22 @@

---

description: >-

description: Review platforms and services supported by AI Security in Cortex XSIAM.

Review platforms and services supported by Cortex Cloud AI Security in Cortex

XSIAM.

---

# Supported services in Cortex Cloud AI Security

hint info

This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

endhint

The following lists the various services that are compatible with Cortex Cloud AI Security, detailing the specific platforms and services where Cortex Cloud AI Security can be effectively used to ensure security and compliance:

The following lists the various services that are compatible with Cloud AI Security, detailing the specific platforms and services where Cloud AI Security can be effectively used to ensure security and compliance:

• AWS: Amazon Bedrock, Amazon SageMaker, Amazon S3 Vectors

• Azure: Azure AI Foundry, Azure OpenAI, Azure AI Search

hint info

Note

Using outpost scan mode is mandatory for full AI asset discovery in Azure. In addition, DSPM must be enabled. Note that you can enable DSPM while disabling it for all non-AI services. For more information, see How to configure the scanning settings for supported services and Cloud service provider onboarding.

endhint

• GCP: Vertex AI

• Self-managed AI models

• SaaS AI Agents

Show markdown source

@@ -1,26 +1,22 @@
 ---
-description: >-
-  Review platforms and services supported by Cortex Cloud AI Security in Cortex
-  XSIAM.
+description: Review platforms and services supported by AI Security in Cortex XSIAM.
 ---
 
 # Supported services in Cortex Cloud AI Security
 
 {% hint style="info" %}
-This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
+Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
 {% endhint %}
 
-The following lists the various services that are compatible with Cortex Cloud AI Security, detailing the specific platforms and services where Cortex Cloud AI Security can be effectively used to ensure security and compliance:
+The following lists the various services that are compatible with Cloud AI Security, detailing the specific platforms and services where Cloud AI Security can be effectively used to ensure security and compliance:
 
 * **AWS:** Amazon Bedrock, Amazon SageMaker, Amazon S3 Vectors
 * **Azure:** Azure AI Foundry, Azure OpenAI, Azure AI Search
 
 {% hint style="info" %}
-**Note**
-
 Using outpost scan mode is mandatory for full AI asset discovery in Azure. In addition, DSPM must be enabled. Note that you can enable DSPM while disabling it for all non-AI services. For more information, see [How to configure the scanning settings for supported services](../../configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/manage-instances/how-to-configure-the-scanning-settings-for-supported-services) and [Cloud service provider onboarding](../../configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding).
 {% endhint %}
 
 * **GCP:** Vertex AI
 * Self-managed AI models
 * [SaaS AI Agents](../cortex-cloud-saas-security/saas-ai-agent-security)

▸ What is Cortex Cloud AI Security? modified +10 −10 Cortex Cloud AI Security became Cloud AI Security throughout, and the licence hint was condensed to name Cloud Posture Security, Cloud Runtime Security or Cortex XSIAM Premium. xsiam/cloud-security/cortex-cloud-ai-security/what-is-cortex-cloud-ai-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,49 +1,49 @@

---

description: >-

Learn how Cortex Cloud AI Security in Cortex XSIAM discovers AI assets,

Learn how Cloud AI Security in Cortex XSIAM discovers AI assets, assesses

assesses risks, and supports remediation.

risks, and supports remediation.

---

# What is Cortex Cloud AI Security?

hint info

This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

endhint

Cortex Cloud AI Security provides:

Cloud AI Security provides:

• Comprehensive Visibility: Obtains a full picture of AI components, including models, agents, data flows, and infrastructure across all cloud environments. This broad visibility ensures that every AI asset is accounted for and continuously monitored, reducing blind spots in the AI ecosystem.

• Full supply chain protection: Maps the dependencies between data, models, and cloud resources to remediate risks such as poisoned datasets or unsanctioned models. Maintains the integrity of your AI bill of materials (AI-BOM).

• Detailed asset inventory: Access an in-depth inventory of all AI assets, enriched with contextual details. This deep insight into each asset’s specifics and functionalities facilitates a better understanding and more effective management of these resources.

• Advanced risk assessment: Proactively identifies and issues alerts on misconfigurations and security flaws in AI assets. Cortex Cloud AI Security employs sophisticated detection mechanisms to tackle risks associated specifically with AI, managing permissions, and ensures robust security practices are upheld throughout the AI supply chain.

• Dynamic risk prioritization: Utilizes insights into data sensitivity and the broader security context to effectively understand and prioritize risks. This strategic approach enables organizations to target and mitigate the most critical threats swiftly, thereby enhancing the overall security landscape.

• Governance and control: Implements comprehensive guardrails and controls for AI models both during development and in production. Ensures that AI assets operate within defined security parameters, reducing the likelihood of security breaches and data leaks.

• Compliance assurance: Regularly tests AI systems against emerging AI regulations and industry standards, such as the OWASP Top 10 for Large Language Models (LLMs). Gets clear guidelines on corrective actions needed to achieve full compliance and ensures that AI assets align with both current and future regulations.

These benefits ensure that using Cortex Cloud AI Security can maintain a robust security posture across your AI environment, proactively manage risks, and align with compliance and internal security policies.

These benefits help you maintain a robust security posture across your AI environment, proactively manage risks, and align with compliance and internal security policies.

#### Cortex Cloud AI Security overview dashboard

#### Cloud AI Security overview dashboard

The Cortex Cloud AI Security overview dashboard serves as the central hub for information on the AI ecosystem within the organization. It provides a comprehensive overview of AI security posture and is designed to help users quickly access relevant information. The layout and organization of the dashboard are tailored to guide you in understanding the AI environment and determining the next steps to take for effective AI governance.

The Cloud AI Security overview dashboard serves as the central hub for information on the AI ecosystem within the organization. It provides a comprehensive overview of AI security posture and is designed to help users quickly access relevant information. The layout and organization of the dashboard are tailored to guide you in understanding the AI environment and determining the next steps to take for effective AI governance.

The following image shows the Cortex Cloud AI Security dashboard:

The following image shows the Cloud AI Security dashboard:

🖼 what_is_AI_security_2.png

#### AI assets inventory

You can view all AI assets in your environment, regardless of deployment mode or cloud provider. Connected assets are discovered, contextualized, and presented with detailed information. You can dive deeper into the asset context as required.

Cortex Cloud AI Security provides visibility into how sensitive data is being utilized and potentially impacted by AI systems. By identifying the AI assets that interact with sensitive data, the platform helps ensure that appropriate protection protocols are applied where most needed, thereby enhancing overall data security and reducing the risk of data breaches and leakage.

Cloud AI Security provides visibility into how sensitive data is being utilized and potentially impacted by AI systems. By identifying the AI assets that interact with sensitive data, the platform helps ensure that appropriate protection protocols are applied where most needed, thereby enhancing overall data security and reducing the risk of data breaches and leakage.

#### AI security issues

Cortex Cloud AI Security provides risk assessment for the supported AI assets, with risk rules created by the research team. These risk rules are designed to detect misconfigurations and security flaws in AI assets and send alerts about them. In addition to the provided default risk rules, Cortex Cloud AI Security also supports custom risk rule creation, so you can codify and integrate internal policies into the Cortex Cloud AI Security risk engine, streamlining your remediation efforts.

Cloud AI Security provides risk assessment for the supported AI assets, with risk rules created by the research team. These risk rules are designed to detect misconfigurations and security flaws in AI assets and send alerts about them. In addition to the provided default risk rules, Cloud AI Security also supports custom risk rule creation, so you can codify and integrate internal policies into the Cortex Cloud AI Security risk engine, streamlining your remediation efforts.

When insecure models and deployments are used, several types of attacks can occur, such as the following:

• Data Poisoning Attacks: In "Training Data Poisoning", malicious actors manipulate the training data to introduce biases or vulnerabilities into the model, causing it to make incorrect or harmful predictions.

• Model Inversion Attacks: Attackers can infer sensitive information about the training data by querying the model, potentially leading to data breaches and loss of intellectual property.

• Adversarial Attacks: Crafted inputs can deceive the model into making incorrect predictions, which is particularly dangerous in critical applications like autonomous driving or medical diagnosis.

• Evasion Attacks: Evasion attacks are a prevalent threat to machine learning models during inference. This type of attack involves crafting inputs that appear normal to humans but are misclassified by machine learning systems. For instance, an adversary might alter a few pixels in an image prior to submission, causing an image recognition system to misidentify it.

• Model Extraction Attacks: Attackers can approximate a model's functionality by repeatedly prompting it, effectively stealing the intellectual property and potentially using it for malicious purposes.

Show markdown source

@@ -1,49 +1,49 @@
 ---
 description: >-
-  Learn how Cortex Cloud AI Security in Cortex XSIAM discovers AI assets,
-  assesses risks, and supports remediation.
+  Learn how Cloud AI Security in Cortex XSIAM discovers AI assets, assesses
+  risks, and supports remediation.
 ---
 
 # What is Cortex Cloud AI Security?
 
 {% hint style="info" %}
-This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
+Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
 {% endhint %}
 
-Cortex Cloud AI Security provides:
+Cloud AI Security provides:
 
 * **Comprehensive Visibility:** Obtains a full picture of AI components, including models, agents, data flows, and infrastructure across all cloud environments. This broad visibility ensures that every AI asset is accounted for and continuously monitored, reducing blind spots in the AI ecosystem.
 * **Full supply chain protection:** Maps the dependencies between data, models, and cloud resources to remediate risks such as poisoned datasets or unsanctioned models. Maintains the integrity of your AI bill of materials (AI-BOM).
 * **Detailed asset inventory:** Access an in-depth inventory of all AI assets, enriched with contextual details. This deep insight into each asset’s specifics and functionalities facilitates a better understanding and more effective management of these resources.
 * **Advanced risk assessment:** Proactively identifies and issues alerts on misconfigurations and security flaws in AI assets. Cortex Cloud AI Security employs sophisticated detection mechanisms to tackle risks associated specifically with AI, managing permissions, and ensures robust security practices are upheld throughout the AI supply chain.
 * **Dynamic risk prioritization:** Utilizes insights into data sensitivity and the broader security context to effectively understand and prioritize risks. This strategic approach enables organizations to target and mitigate the most critical threats swiftly, thereby enhancing the overall security landscape.
 * **Governance and control:** Implements comprehensive guardrails and controls for AI models both during development and in production. Ensures that AI assets operate within defined security parameters, reducing the likelihood of security breaches and data leaks.
 * **Compliance assurance:** Regularly tests AI systems against emerging AI regulations and industry standards, such as the OWASP _Top 10 for Large Language Models (LLMs)_. Gets clear guidelines on corrective actions needed to achieve full compliance and ensures that AI assets align with both current and future regulations.
 
-These benefits ensure that using Cortex Cloud AI Security can maintain a robust security posture across your AI environment, proactively manage risks, and align with compliance and internal security policies.
+These benefits help you maintain a robust security posture across your AI environment, proactively manage risks, and align with compliance and internal security policies.
 
-#### Cortex Cloud AI Security overview dashboard
+#### Cloud AI Security overview dashboard
 
-The Cortex Cloud AI Security overview dashboard serves as the central hub for information on the AI ecosystem within the organization. It provides a comprehensive overview of AI security posture and is designed to help users quickly access relevant information. The layout and organization of the dashboard are tailored to guide you in understanding the AI environment and determining the next steps to take for effective AI governance.
+The Cloud AI Security overview dashboard serves as the central hub for information on the AI ecosystem within the organization. It provides a comprehensive overview of AI security posture and is designed to help users quickly access relevant information. The layout and organization of the dashboard are tailored to guide you in understanding the AI environment and determining the next steps to take for effective AI governance.
 
-The following image shows the Cortex Cloud AI Security dashboard:
+The following image shows the Cloud AI Security dashboard:
 
 ![what\_is\_AI\_security\_2.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FWx12D2gjD6oKUhN6Y2Z3%2F703655b66477646f7bd5f49da85eee053e3395c8f31aa768a557998b0bf0b729.png?alt=media\&token=eddee0dd-b090-4a5a-b707-0de3926c8c2d)
 
 #### AI assets inventory
 
 You can view all AI assets in your environment, regardless of deployment mode or cloud provider. Connected assets are discovered, contextualized, and presented with detailed information. You can dive deeper into the asset context as required.
 
-Cortex Cloud AI Security provides visibility into how sensitive data is being utilized and potentially impacted by AI systems. By identifying the AI assets that interact with sensitive data, the platform helps ensure that appropriate protection protocols are applied where most needed, thereby enhancing overall data security and reducing the risk of data breaches and leakage.
+Cloud AI Security provides visibility into how sensitive data is being utilized and potentially impacted by AI systems. By identifying the AI assets that interact with sensitive data, the platform helps ensure that appropriate protection protocols are applied where most needed, thereby enhancing overall data security and reducing the risk of data breaches and leakage.
 
 #### AI security issues
 
-Cortex Cloud AI Security provides risk assessment for the supported AI assets, with risk rules created by the research team. These risk rules are designed to detect misconfigurations and security flaws in AI assets and send alerts about them. In addition to the provided default risk rules, Cortex Cloud AI Security also supports custom risk rule creation, so you can codify and integrate internal policies into the Cortex Cloud AI Security risk engine, streamlining your remediation efforts.
+Cloud AI Security provides risk assessment for the supported AI assets, with risk rules created by the research team. These risk rules are designed to detect misconfigurations and security flaws in AI assets and send alerts about them. In addition to the provided default risk rules, Cloud AI Security also supports custom risk rule creation, so you can codify and integrate internal policies into the Cortex Cloud AI Security risk engine, streamlining your remediation efforts.
 
 When insecure models and deployments are used, several types of attacks can occur, such as the following:
 
 * **Data Poisoning Attacks:** In "Training Data Poisoning", malicious actors manipulate the training data to introduce biases or vulnerabilities into the model, causing it to make incorrect or harmful predictions.
 * **Model Inversion Attacks:** Attackers can infer sensitive information about the training data by querying the model, potentially leading to data breaches and loss of intellectual property.
 * **Adversarial Attacks:** Crafted inputs can deceive the model into making incorrect predictions, which is particularly dangerous in critical applications like autonomous driving or medical diagnosis.
 * **Evasion Attacks:** Evasion attacks are a prevalent threat to machine learning models during inference. This type of attack involves crafting inputs that appear normal to humans but are misclassified by machine learning systems. For instance, an adversary might alter a few pixels in an image prior to submission, causing an image recognition system to misidentify it.
 * **Model Extraction Attacks:** Attackers can approximate a model's functionality by repeatedly prompting it, effectively stealing the intellectual property and potentially using it for malicious purposes.

▸ Cortex Cloud Application Security modified +4 −4 xsiam/cloud-security/cortex-cloud-application-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,12 +1,12 @@

---

description: >-

Discover Cortex XSIAM Cortex Cloud Application Security for ASPM, supply chain

Discover Cortex XSIAM Application Security for ASPM, supply chain security,

security, and code security.

and code security.

---

# Cortex Cloud Application Security

The Cortex Cloud Application Security module provides comprehensive security for your applications throughout their entire lifecycle. It offers unified visibility and control over your application's security from development through to deployment.

## Use cases

@@ -20,17 +20,17 @@ To enable and utilize the components of the Application Security module, an acti

While some features are included by default, others require a dedicated add-on purchase.

## Base licenses

You must have at least one of the following active base licenses to access the Application Security module:

• Cloud Posture Security or Cloud Runtime Security

• XSIAM Premium

• Cortex XSIAM Premium

### Module components

• Application Security Posture Management (ASPM): Included with base license

• Supply Chain Security: Included with base license

• Code security: Requires a separate Application Security Add-on purchase in addition to your existing Cloud (Posture or Runtime) or XSIAM Premium base license

• Code security: Requires a separate Application Security Add-on purchase in addition to your existing Cloud (Posture or Runtime) or Cortex XSIAM Premium base license

For more information, see Cortex Cloud Application Security

Show markdown source

@@ -1,12 +1,12 @@
 ---
 description: >-
-  Discover Cortex XSIAM Cortex Cloud Application Security for ASPM, supply chain
-  security, and code security.
+  Discover Cortex XSIAM Application Security for ASPM, supply chain security,
+  and code security.
 ---
 
 # Cortex Cloud Application Security
 
 The Cortex Cloud Application Security module provides comprehensive security for your applications throughout their entire lifecycle. It offers unified visibility and control over your application's security from development through to deployment.
 
 ## Use cases
 
@@ -20,17 +20,17 @@ To enable and utilize the components of the Application Security module, an acti
 
 While some features are included by default, others require a dedicated add-on purchase.
 
 ## Base licenses
 
 You must have at least one of the following active base licenses to access the Application Security module:
 
 * Cloud Posture Security or Cloud Runtime Security
-* XSIAM Premium
+* Cortex XSIAM Premium
 
 ### Module components
 
 * Application Security Posture Management (ASPM): Included with base license
 * Supply Chain Security: Included with base license
-* Code security: Requires a separate **Application Security Add-on** purchase in addition to your existing Cloud (Posture or Runtime) or XSIAM Premium base license
+* Code security: Requires a separate **Application Security Add-on** purchase in addition to your existing Cloud (Posture or Runtime) or Cortex XSIAM Premium base license
 
 For more information, see [Cortex Cloud Application Security](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/8Z0RLJ1BFF5TQL8VtUeK/)

▸ Cortex Cloud SaaS Security modified +5 −5 xsiam/cloud-security/cortex-cloud-saas-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,36 +1,36 @@

---

description: >-

SaaS Security delivers continuous visibility and control across SaaS

Discover continuous SaaS visibility and control in Cortex XSIAM across

identities, connected apps, and AI agents.

identities, connected applications, and AI agents.

---

# Cortex Cloud SaaS Security

Software-as-a-Service (SaaS) environments optimize end-user workflows through rapid provisioning and native collaboration capabilities. However, this decentralized architecture presents a significant visibility challenge for cybersecurity.

Your security teams have to contend with the difficult task of managing this proliferation of both sanctioned and unsanctioned applications, while ensuring consistent cloud compliance and mitigating risks to critical information and users.

hint info

Note: SaaS Security is currently in Beta with limited availability. Contact your Customer Service Representative to activate SaaS Security in your environment.

endhint

SaaS Security offers a robust framework that:

• Delivers full visibility into security misconfigurations and ensures continuous hardening of the SaaS environment.

• Defends cloud applications against both identified and emerging threats.

• Ensures data protection and compliance across the entire SaaS environment.

• Restricts corporate application access to authorized individuals only.

• Hardens AI agent deployments to mitigate risks like prompt injections and unauthorized data movement.

\

To deliver these outcomes, the platform utilizes the following pillars:

• Implement SaaS Security Checks for continuous oversight of security configurations.

• Apply SaaS Agent Security for automated enforcement and visibility of AI agents on platforms such as Salesforce and Microsoft Copilot.

• Deploy Data Security for deep inspection and remediation of at-rest assets within sanctioned environments.

• SaaS Identity Security gives you the tools to implement Zero Trust access controls to defend against malicious insiders and sophisticated threat actors.

• SaaS Threat Security proactively identifies anomalous behaviors and simplifies monitoring with user risk scores and predefined situational policies.

Show markdown source

@@ -1,36 +1,36 @@
 ---
 description: >-
-  SaaS Security delivers continuous visibility and control across SaaS
-  identities, connected apps, and AI agents.
+  Discover continuous SaaS visibility and control in Cortex XSIAM across
+  identities, connected applications, and AI agents.
 ---
 
 # Cortex Cloud SaaS Security
 
 Software-as-a-Service (SaaS) environments optimize end-user workflows through rapid provisioning and native collaboration capabilities. However, this decentralized architecture presents a significant visibility challenge for cybersecurity.
 
 Your security teams have to contend with the difficult task of managing this proliferation of both sanctioned and unsanctioned applications, while ensuring consistent cloud compliance and mitigating risks to critical information and users.
 
 <figure><img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FQBxyJ8Mv26SYFS7mYKn6%2Fsaas-horizontal-2.gif?alt=media&#x26;token=1d805f79-2814-40b5-b7ca-d50aa82ad41d" alt=""><figcaption></figcaption></figure>
 
 {% hint style="info" %}
-Note: SaaS Security is currently in Beta with limited availability. Contact your Customer Service Representative to activate SaaS Security in your environment.&#x20;
+Note: SaaS Security is currently in Beta with limited availability. Contact your Customer Service Representative to activate SaaS Security in your environment.
 {% endhint %}
 
 SaaS Security offers a robust framework that:
 
 * Delivers full visibility into security misconfigurations and ensures continuous hardening of the SaaS environment.
 * Defends cloud applications against both identified and emerging threats.
 * Ensures data protection and compliance across the entire SaaS environment.
 * Restricts corporate application access to authorized individuals only.
 * Hardens AI agent deployments to mitigate risks like prompt injections and unauthorized data movement.
 
 \
 To deliver these outcomes, the platform utilizes the following pillars:
 
 * Implement SaaS Security Checks for continuous oversight of security configurations.
-* Apply SaaS Agent Security for automated enforcement and visibility of AI agents on platforms such as Salesforce and Microsoft Copilot.&#x20;
-* Deploy Data Security for deep inspection and remediation of at-rest assets within sanctioned environments.&#x20;
+* Apply SaaS Agent Security for automated enforcement and visibility of AI agents on platforms such as Salesforce and Microsoft Copilot.
+* Deploy Data Security for deep inspection and remediation of at-rest assets within sanctioned environments.
 * SaaS Identity Security gives you the tools to implement Zero Trust access controls to defend against malicious insiders and sophisticated threat actors.
 * SaaS Threat Security proactively identifies anomalous behaviors and simplifies monitoring with user risk scores and predefined situational policies.
 
 <br>

▸ Connect a SaaS application modified +41 −43 Every per-app onboarding link in the SaaS app connection table became broken-reference; the inline instructions for Nintex, Ping, Pipedrive, Qualtrics, Splunk and VMware are untouched. xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,64 +1,62 @@

---

description: >-

Connect a supported SaaS application to track and monitor misconfigurations

Connect supported SaaS applications in Cortex XSIAM to track misconfigurations

and compliance violations.

---

# Connect a SaaS application

To detect posture risks, applications must first be connected to Cortex SaaS Security and have the necessary permissions to scan SaaS application settings. During data connection, Cortex SaaS Security prompts you for the configuration information required to establish a connection with the SaaS app. The configuration information that SaaS Security requires differs from app to app, and you might need to collect configuration information prior to onboarding.

When you connect an application you may also be prompted to provide required for application connection, such as administrator credentials for a service account. The required information varies, and in many cases you must first take some actions on the SaaS app, such as creating an API key.

The following table provides links to detailed connection instructions for most applications. Where detailed instructions are not available for a particular SaaS application, the table includes the relevant onboarding steps.

SaaS app connection steps

| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Aha.io

Asana

Atlassian

Automox

BusinessMap

Celonis

Cisco Duo

Cisco Meraki

Clickup

Contentful

Couchbase

Coveo

Databricks

DataDog

Gainsight

Grammarly

Harness

Intercom

Jamf Pro

Jumpcloud

Kustomer

Microsoft Entra

Monday

MongoDB

Mulesoft

Mural

@@ diff truncated @@

Show markdown source

@@ -1,64 +1,62 @@
 ---
 description: >-
-  Connect a supported SaaS application to track and monitor misconfigurations
+  Connect supported SaaS applications in Cortex XSIAM to track misconfigurations
   and compliance violations.
 ---
 
 # Connect a SaaS application
 
 To detect posture risks, applications must first be connected to Cortex SaaS Security and have the necessary permissions to scan SaaS application settings. During data connection, Cortex SaaS Security prompts you for the configuration information required to establish a connection with the SaaS app. The configuration information that SaaS Security requires differs from app to app, and you might need to collect configuration information prior to onboarding.
 
 When you connect an application you may also be prompted to provide required for application connection, such as administrator credentials for a service account. The required information varies, and in many cases you must first take some actions on the SaaS app, such as creating an API key.
 
 The following table provides links to detailed connection instructions for most applications. Where detailed instructions are not available for a particular SaaS application, the table includes the relevant onboarding steps.
 
-
-
 | **SaaS app connection steps**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Aha.io](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-aha.io)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| [Asana](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-asana)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| [Atlassian](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-atlassian)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| [Automox](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-automox)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [BusinessMap](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-businessmap)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| [Celonis](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-celonis)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [Cisco Duo](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-cisco-duo)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| [Cisco Meraki](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-cisco-meraki)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-|  [Clickup](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-clickup)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| [Contentful](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-contentful)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| [Couchbase](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-couchbase)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| [Coveo](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-coveo)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-|  [Databricks](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-databricks)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-|  [DataDog](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-datadog)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-|  [Gainsight](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-gainsight-px)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| [Grammarly](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-grammarly)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-|  [Harness](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-harness)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-|  [Intercom](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-intercom)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-|  [Jamf Pro](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-jamf-pro)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| [Jumpcloud](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-jumpcloud)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-|  [Kustomer](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-kustomer)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-|  [Microsoft Entra](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-microsoft-entra-id)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| [Monday](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-monday.com)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-|  [MongoDB](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-mongodb-atlas)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| [Mulesoft](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-mulesoft)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| [Mural](../cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-mural)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| [Aha.io](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| [Asana](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| [Atlassian](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| [Automox](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| [BusinessMap](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| [Celonis](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| [Cisco Duo](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| [Cisco Meraki](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| [Clickup](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| [Contentful](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| [Couchbase](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| [Coveo](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| [Databricks](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| [DataDog](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| [Gainsight](broken-reference)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
@@ diff truncated @@

▸ Onboard Aha.io modified +25 −25 xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-aha.io

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,55 +1,55 @@

---

description: Onboard Aha.io to track misconfigurations and monitor application compliance.

description: >-

Onboard Aha.io in Cortex XSIAM to track misconfigurations and application

compliance.

---

# Onboard Aha.io

For SaaS Security to detect posture risks in your Aha.io instance, you must onboard your Aha.io instance to SaaS Security. Through the onboarding process, SaaS Security logs in to Aha.io using administrator account credentials. This account is used to scan your Aha.io instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

SaaS Security gets access to your Aha.io instance by using Okta SSO or Microsoft Azure credentials that you provide during the onboarding process. For this reason, your organization must be using Okta or Microsoft Azure as an identity provider. The Okta or Microsoft Azure account must be configured for multi-factor authentication (MFA) using one-time passcodes.

\

To onboard your Aha.io instance, you must complete the following actions: