Documentation — August 26, 2026
447 files changed, 2598 insertions, 1395 deletions — view the commit on the mirror.
Container registry scanning regrouped by vendor; Identity Profile version floor drops to XSIAM 3.5
- Registry scanning is now licensed by either the Cloud Posture Security or the Cloud Runtime Security add-on, where before only Cloud Runtime Security qualified.
- Twelve container registry pages moved out of Cloud Posture and Runtime Security data sources into per-vendor folders under Vendor-specific data sources and connectors.
- Identity Profile now names Cortex XSIAM 3.5, Cortex XDR 5.1 or Cortex Cloud Runtime 2.1 instead of a flat XSIAM 3.6 floor, and is explicitly unavailable on XSIAM 2.x and XDR 3.x.
- Ubuntu 26 gains supported-kernel pages on x86_64 and aarch64 at agent 9.1.0, alongside newly certified kernels across AlmaLinux, Rocky, RHEL, Oracle, Amazon Linux and Ubuntu.
- Most of the day’s 448 files are an editorial pass: 182 XSIAM pages and most of the 75 Development Guide pages had descriptions and headings rewritten without changing meaning.
Highlights
-
Container registry scanning is now included with the Cloud Posture Security add-on as well
The License type note gained "the Cloud Posture Security or" before "the Cloud Runtime Security add-on", widening which products cover the feature.
-
The six registry connectors moved to per-vendor folders, breaking their old URLs
Docker Hub, Docker V2, GitLab, Harbor, JFrog and Sonatype Nexus and their manage- subpages left container-registry-scanning/ for vendor-specific-data-sources-and-connectors/<vendor>/.
-
Identity Profile prerequisites were restated across three products
"Cortex XSIAM 3.6 or later" became "Cortex XSIAM 3.5, Cortex XDR 5.1, or Cortex Cloud Runtime 2.1 or later", still requiring agent 9.1 and the ITDR add-on.
-
Ubuntu 26 is now a supported kernel platform
New x86_64 and aarch64 pages list 7.0.0-14-generic onward at a 9.1.0 minimum agent version, taking the Linux Kernel Versions book from 100 to 102 pages.
-
The Development Guide's Alerts page is now Issues
Alert fields, layouts, layout rules and mappers were all restated as issue equivalents; the page keeps its alerts.md path, so only the title and body moved.
-
The Broker VM registry scanner page now links to broken-reference six times
Its links to the six connector pages were replaced with the literal placeholder broken-reference rather than repointed at the new vendor paths.
Bulk change — 447 files. Per-file diffs are not stored for a change this size; view it on the mirror.
Changes
447 files listed, 15 written up and shaded below.
-
▸ ▾ CrowdStrike modified +1 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrikeRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Ingest raw EDR events from CrowdStrike Falcon Data Replicator modified +1 −1
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrike/crowdstrike-falcon-data-replicator/ingest-raw-edr-events-from-crowdstrike-falcon-data-replicatorRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ CryptoCurrency modified +1 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cryptocurrencyRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Cuckoo Sandbox modified +1 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cuckoo-sandboxRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Cursor modified +1 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cursorRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ CybelAngel modified +1 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cybelangelRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Docker added +2 −0 New page, a title-only stub that parents the two Docker connector pages in the navigation.
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dockerRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Connect Docker Hub registry renamed +4 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker/connect-docker-hub-registryRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-docker-hub-registry.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage a Docker Hub connector renamed +0 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker/connect-docker-hub-registry/manage-a-docker-hub-connectorRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-docker-hub-registry/manage-a-docker-hub-connector.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Connect Docker V2 compliant container registry renamed +7 −1 The pointer to the Docker Hub connector for public and private repositories is now formatted as a Note hint.
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker/connect-docker-v2-compliant-container-registryRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-docker-v2-compliant-container-registry.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage a Docker V2 connector renamed +0 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker/connect-docker-v2-compliant-container-registry/manage-a-docker-v2-connectorRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-docker-v2-compliant-container-registry/manage-a-docker-v2-connector.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ GitLab modified +7 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitlabRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Connect GitLab container registry renamed +7 −1
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitlab/connect-gitlab-container-registryRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-gitlab-container-registry.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage a GitLab Container Registry connector renamed +0 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitlab/connect-gitlab-container-registry/manage-a-gitlab-container-registry-connectorRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-gitlab-container-registry/manage-a-gitlab-container-registry-connector.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Harbor added +2 −0 New title-only stub parenting the Harbor registry connector page.
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/harborRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Connect Harbor registry renamed +8 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/harbor/connect-harbor-registryRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-harbor-registry.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage a Harbor connector renamed +0 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/harbor/connect-harbor-registry/manage-a-harbor-connectorRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-harbor-registry/manage-a-harbor-connector.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ JFrog added +2 −0 New title-only stub parenting the JFrog container registry connector page.
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jfrogRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Connect JFrog container registry renamed +5 −1
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jfrog/connect-jfrog-container-registryRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-jfrog-container-registry.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage a JFrog connector renamed +0 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jfrog/connect-jfrog-container-registry/manage-a-jfrog-connectorRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-jfrog-container-registry/manage-a-jfrog-connector.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Ingest authentication logs and data from PingOne modified +0 −6
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ping-identity/pingone/ingest-authentication-logs-and-data-from-pingoneRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Salesforce modified +6 −6
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/salesforceRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Sonatype Nexus added +2 −0 New title-only stub parenting the Sonatype Nexus registry connector page.
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sonatype-nexusRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Connect Sonatype Nexus registry renamed +4 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sonatype-nexus/connect-sonatype-nexus-registryRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-sonatype-nexus-registry.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage a Sonatype connector renamed +0 −0
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sonatype-nexus/connect-sonatype-nexus-registry/manage-a-sonatype-connectorRead it on the Cortex docs portal ↗ This file's diff on GitHub ↗ moved from
xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/connect-sonatype-nexus-registry/manage-a-sonatype-connector.mdDiffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ How to map authentication events for analytics modified +1 −1
xsiam/configure-cortex-xsiam/data-management/data-model-rules/how-to-map-authentication-story-eventsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Managed Services configuration modified +1 −1
xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/managed-services-configurationRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Step 1. Activate Cortex XSIAM (main account) modified +1 −1
xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments/step-1.-activate-cortex-xsiam-main-accountRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Step 1. Active Cortex XSIAM (parent and child tenants) modified +1 −1
xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-1.-active-cortex-xsiam-parent-and-child-tenantsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Step 3. Pair a parent tenant with a child tenant modified +0 −1
xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-3.-pair-a-parent-tenant-with-a-child-tenantRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Agentic Assistant chat modified +3 −1
xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chatRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Chat with an Agentic Assistant agent modified +1 −1
xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-an-agentic-assistant-agentRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Chat with the Agentic Assistant from Slack modified +1 −1
xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-the-agentic-assistant-from-slackRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Choose an Agentic Assistant agent modified +1 −1
xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/choose-an-agentic-assistant-agentRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create and run XQL queries with Agentic Assistant chat modified +3 −1
xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chatRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Get started with Agentic Assistant chat modified +1 −1
xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/get-started-with-agentic-assistant-chatRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage chat history modified +3 −1
xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/manage-chat-historyRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Use natural language to query and visualize your data modified +1 −1
xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/use-natural-language-to-query-and-visualize-your-dataRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Asset groups modified +1 −1
xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-groupsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Vulnerability Assessment modified +1 −1
xsiam/detect-investigate-and-respond-to-threats/asset-management/vulnerability-assessmentRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage user asset roles modified +1 −3
xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/asset-rolesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Enforce dynamic access control with CAP modified +1 −1
xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/conditional-access-policyRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Get started with ITDR modified +5 −4 Identity Profile described as available on Windows endpoints rather than as a Windows-only profile.
xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/get-started-with-itdrRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Investigate user risk modified +2 −3
xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/investigate-user-riskRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage role based access control (RBAC) in ITDR modified +0 −1
xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/manage-role-based-access-control-rbac-in-itdrRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Monitor user risk exposure modified +0 −3
xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/monitor-user-risk-exposureRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Prevent malicious LDAP queries modified +2 −2
xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/prevent-malicious-ldap-queriesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Build XQL queries modified +3 −3
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queriesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ About the Query Builder modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/about-the-query-builderRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Federated Search modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-searchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Federated Search configuration modified +5 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search/federated-search-configurationRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage external datasets modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search/manage-external-datasetsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Query using Federated Search modified +4 −3
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search/query-using-federated-searchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ How to build XQL queries modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queriesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create XQL query modified +4 −2
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/create-xql-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Expected results when querying fields modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fieldsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Get started with XQL queries modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queriesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Graph query results modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/graph-query-resultsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Review XQL query results modified +5 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-resultsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Translate to XQL modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/translate-to-xqlRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Useful XQL user interface features modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-featuresRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ XQL Query best practices modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/xql-query-best-practicesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Legacy Query Builder modified +1 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builderRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create authentication query modified +7 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-authentication-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create event log query modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-event-log-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create file query modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-file-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create image load query modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-image-load-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create network connections query modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-connections-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create network query modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create process query modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-process-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create registry query modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-registry-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Query across all entities modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/query-across-all-entitiesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage scheduled queries modified +2 −2
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-scheduled-queriesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Scheduled Queries reference information modified +5 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-informationRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage your macros modified +4 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-your-macrosRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage your personal query library modified +2 −2
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-your-personal-query-libraryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Overview of the Query Center modified +1 −3
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/overview-of-the-query-centerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Edit and run queries in Query Center modified +5 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-centerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Query Center reference information modified +5 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/overview-of-the-query-center/query-center-reference-informationRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Query Builder templates modified +2 −2
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templatesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Considerations for using Query Builder templates modified +5 −3
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templatesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create a query from a template modified +5 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/create-a-query-from-a-templateRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Get started with Query Builder templates modified +5 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/get-started-with-query-builder-templatesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Query Builder template examples modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/query-builder-template-examplesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Run a free text query modified +5 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/run-a-free-text-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ XQL macros modified +4 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/xql-macrosRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Cortex Assistant modified +3 −4
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/cortex-assistantRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Cortex Assistant capabilities modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/cortex-assistant/cortex-assistant-capabilitiesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Cortex Assistant layout modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/cortex-assistant/cortex-assistant-layoutRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Forensics modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensicsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Analysis and documentation modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/analysis-and-documentationRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Data collection modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collectionRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Configure collection modified +7 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/configure-collectionRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Hunting modified +7 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/huntingRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create a hunt modified +8 −2
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting/create-a-huntRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Hunt results modified +7 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting/hunt-resultsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Hunt status modified +5 −1
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting/hunt-statusRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Triage modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create a triage modified +8 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/create-a-triageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Offline triage collection modified +6 −0
xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/offline-triage-collectionRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.