Documentation — August 27, 2026

▸ README modified +1 −1 The Cortex XSIAM Documentation page count falls from 2,223 to 2,218 — six pages deleted, one added. README

This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

▸ Navigation manifest (xsiam) modified +7 −38 .meta/xsiam

This file's diff on GitHub ↗

The book's page tree and ordering — not a documentation page, so no diff is kept. The counts above still say how much moved.

▸ Cloud Posture and Runtime Security data sources modified +12 −0 Gains a list of supported sources, but the DSPM Fileshare entry links to the DSPM Database page and AppSec Transporter is listed twice. xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -14,8 +14,20 @@ Cloud Posture Management and Cloud Runtime Security have their own data sources

Relevant Cloud Posture and Runtime data source types:

• Container Registry connectors: A Runtime data source category that integrates with supported container registries like Amazon ECR, Docker Hub, and JFrog to automatically scan container images for vulnerabilities and other security risks.

• Posture management connectors: Provides specialized onboarding to identify misconfigurations in SaaS and data platforms like Snowflake and Microsoft 365 (Posture).

• Discovery engine: Performs regular scans and uses Event Assisted Ingestion (EAI) to track near-real-time changes to cloud assets and VMs.

• Serverless function security: Provides agentless scanning for vulnerabilities in serverless code and pipelines for AWS Lambda, GCP, and Azure functions.

• Cloud data security (DSPM): Discovers and classifies sensitive data across managed storage, such as S3 and Cloud SQL, and self-managed databases.

The following Cloud Posture and Runtime Security data sources are supported:

• AppSec Transporter applet

• Databricks

• DSPM Database applet

• DSPM Fileshare applet

• Microsoft 365

• Okta

• Registry Scanner applet

• Snowflake

• AppSec Transporter

Show markdown source

@@ -14,8 +14,20 @@ Cloud Posture Management and Cloud Runtime Security have their own data sources
 
 **Relevant Cloud Posture and Runtime data source types:**
 
 * **Container Registry connectors**: A Runtime data source category that integrates with supported container registries like Amazon ECR, Docker Hub, and JFrog to automatically scan container images for vulnerabilities and other security risks.
 * **Posture management connectors**: Provides specialized onboarding to identify misconfigurations in SaaS and data platforms like Snowflake and Microsoft 365 (Posture).
 * **Discovery engine**: Performs regular scans and uses Event Assisted Ingestion (EAI) to track near-real-time changes to cloud assets and VMs.
 * **Serverless function security**: Provides agentless scanning for vulnerabilities in serverless code and pipelines for AWS Lambda, GCP, and Azure functions.
 * **Cloud data security (DSPM)**: Discovers and classifies sensitive data across managed storage, such as S3 and Cloud SQL, and self-managed databases.
+
+The following Cloud Posture and Runtime Security data sources are supported:
+
+* [AppSec Transporter applet](generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-transporter)
+* [Databricks](vendor-specific-data-sources-and-connectors/databricks/how-to-onboard-databricks)
+* [DSPM Database applet](generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-database)
+* [DSPM Fileshare applet](generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-database)
+* [Microsoft 365](vendor-specific-data-sources-and-connectors/microsoft/microsoft-365-posture/how-to-onboard-microsoft-365)
+* [Okta](vendor-specific-data-sources-and-connectors/okta/ingest-logs-and-data-from-okta)
+* [Registry Scanner applet](generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-registry-scanner)
+* [Snowflake](vendor-specific-data-sources-and-connectors/snowflake/how-to-onboard-snowflake)
+* [AppSec Transporter](generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-transporter)

▸ How to onboard Databricks deleted +0 −82 Deleted; the copy under the Databricks vendor page is now the only one.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/how-to-onboard-databricks

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,82 +0,0 @@

---

description: Add Databricks as a Cortex XSIAM data source.

---

# How to onboard Databricks

hint info

### Notice

This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

endhint

Overview

You can add the Databricks platform as a third-party data source in Cortex Cloud Data Security.

Prerequisites

• To use Databricks, you must be registered.

• Make sure you have the following account permissions to onboard:

• Account Admin: For information about this role, see Set up users, groups, and roles.

• Metastore Admin: Databricks admin that can only be assigned by an Account Admin. Databricks recommends assigning this role to a group rather than an individual user to facilitate management and ensure continuity in case an individual leaves the organization.

• Make sure you have the following ID numbers at hand:

• Account ID: Refers to the unique identifier of the user account.

How to find the Account ID

1. Log in to the account console.

2. In the account console, your username should appear in the upper right corner of the page.

3. Click the icon of your username.

4. Your account ID appears in the list.

• Application ID: Refers to the unique identifier for a service principal in Databricks.

How to find the Application ID

1. Log in to the account console.

2. Click User Management and navigate to the Service Principals tab.

3. Click the name of the service principal for which you need the Application ID. The service principal must also be the account admin.

4. On the service principal settings page, navigate to the Configuration tab.

5. The Application ID appears in the list.

### Add the Databricks data source

To add the Databricks platform as a data source, you need to add configuration details, establish a connection, and then verify the connection.

Add configuration details

1. Navigate to Settings → Data Sources & Integrations.

2. On the Data Sources & Integrations page, click + Add New.

3. On the Add Data Sources or Integrations page, search for Databricks, then hover over it and click Add.

4. On the Databricks integration instance settings page, for the Configuration step, do the following:

1. Enter the display name for your Databricks integration instance.

2. Enter your Databricks Account ID.

3. Enter your Application ID.

4. Select a cloud platform.

5. (Optional) Turn on the toggle for My Databricks account protected by network policies and select a region.

       <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you turn on this feature, both the cloud and region will be used for scanning, possibly incurring cost and requiring adherence to certain compliance policies.</p></div>

6. Click Next.

5. Click Next.

### Establish a connection

1. For the Establish Connection step, you are now instructed to open your Databricks console in a new browser tab.

2. On the Establish Connection tab, click the arrow to open the Generated script code block. Do one or both of the following:

• Click the cloud icon to download the .sh script file.

• Click the copy icon to copy the script to your clipboard.

3. Run the script in your Databricks CLI.

4. Click Verify Connection.

Verify the connection

1. For the Verify Connection step, if the connection is verified, a confirmation message is displayed.

2. Click Close.

Databricks now appears in the list of data sources on the Data Sources & Integrations page.

### Verify the Cortex Gateway connection

At the end of the onboarding process, a pending request for Databricks approval is automatically created and displayed on the Cortex Gateway screen. To complete the onboarding process, approve the pending request. If you do not have permissions, contact your Cortex Cloud administrator.

For more information, see Egress configurations.

Show markdown source

@@ -1,82 +0,0 @@
----
-description: Add Databricks as a Cortex XSIAM data source.
----
-
-# How to onboard Databricks
-
-{% hint style="info" %}
-### Notice
-
-This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
-{% endhint %}
-
-**Overview**
-
-You can add the Databricks platform as a third-party data source in Cortex Cloud Data Security.
-
-**Prerequisites**
-
-* To use Databricks, you must be registered.
-* Make sure you have the following account permissions to onboard:
-  * `Account Admin`: For information about this role, see [Set up users, groups, and roles](../../../onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles).
-  * `Metastore Admin`: Databricks admin that can only be assigned by an `Account Admin`. Databricks recommends assigning this role to a group rather than an individual user to facilitate management and ensure continuity in case an individual leaves the organization.
-* Make sure you have the following ID numbers at hand:
-  *   **Account ID:** Refers to the unique identifier of the user account.
-
-      How to find the Account ID
-
-      1. Log in to the account console.
-      2. In the account console, your username should appear in the upper right corner of the page.
-      3. Click the icon of your username.
-      4. Your account ID appears in the list.
-  *   **Application ID:** Refers to the unique identifier for a service principal in Databricks.
-
-      How to find the Application ID
-
-      1. Log in to the account console.
-      2. Click **User Management** and navigate to the **Service Principals** tab.
-      3. Click the name of the service principal for which you need the Application ID. The service principal must also be the account admin.
-      4. On the service principal settings page, navigate to the **Configuration** tab.
-      5. The Application ID appears in the list.
-
-### **Add the Databricks data source**
-
-To add the Databricks platform as a data source, you need to add configuration details, establish a connection, and then verify the connection.
-
-Add configuration details
-
-1. Navigate to **Settings** → **Data Sources & Integrations**.
-2. On the **Data Sources & Integrations** page, click **+ Add New**.
-3. On the **Add Data Sources or Integrations** page, search for **Databricks**, then hover over it and click **Add**.
-4. On the **Databricks** integration instance settings page, for the **Configuration** step, do the following:
-   1. Enter the display name for your Databricks integration instance.
-   2. Enter your Databricks Account ID.
-   3. Enter your Application ID.
-   4. Select a cloud platform.
-   5.  (Optional) Turn on the toggle for **My Databricks account protected by network policies** and select a region.
-
-       <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you turn on this feature, both the cloud and region will be used for scanning, possibly incurring cost and requiring adherence to certain compliance policies.</p></div>
-   6. Click **Next**.
-5. Click **Next**.
-
-### Establish a connection
-
-1. For the **Establish Connection** step, you are now instructed to open your Databricks console in a new browser tab.
-2. On the **Establish Connection** tab, click the arrow to open the **Generated script** code block. Do one or both of the following:
-   * Click the cloud icon to download the .sh script file.
-   * Click the copy icon to copy the script to your clipboard.
-3. Run the script in your Databricks CLI.
-4. Click **Verify Connection**.
-
-Verify the connection
-
-1. For the **Verify Connection** step, if the connection is verified, a confirmation message is displayed.
-2. Click **Close**.
-
-**Databricks** now appears in the list of data sources on the **Data Sources & Integrations** page.
-
-### **Verify the Cortex Gateway connection**
-
-At the end of the onboarding process, a pending request for Databricks approval is automatically created and displayed on the Cortex Gateway screen. To complete the onboarding process, approve the pending request. If you do not have permissions, contact your Cortex Cloud administrator.
-
-For more information, see [Egress configurations](https://app.gitbook.com/s/SqEFcjERpi4JSgB9LjVw/egress-configurations).

▸ How to onboard Microsoft 365 deleted +0 −36 Deleted; the copy under Microsoft 365 (Posture) in the vendor tree is now the only one.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/how-to-onboard-microsoft-365

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,36 +0,0 @@

---

description: Add Microsoft 365 as a Cortex XSIAM data source.

---

# How to onboard Microsoft 365

hint info

This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

endhint

You can add Microsoft 365 as a third-party data source in Cortex Cloud Data Security.

hint warning

Prerequisites

• You have generated a Globally Unique Identifier (GUID), also known as a Universally Unique Identifier (UUID). You will need this ID for the tenant you want to use for the Microsoft 365 instance.

• To use Microsoft 365, you must be registered with Microsoft Azure.

endhint

Configuration

1. Navigate to Settings → Data Sources & Integrations.

2. On the Data Sources & Integrations page, click + Add New.

3. On the Add Data Sources or Integrations page, search for Microsoft 365, then hover over it and click Add.

4. On the Microsoft 365 integration instance settings page, do the following:

1. In the Display Name field, enter a name for your Microsoft 365 integration instance.

2. In the Tenant ID field, enter a tenant ID.

3. In the Region list, select a region.

5. Click Next.

Authorization

1. On the Microsoft 365 Instance screen, if you are an administrator, click the click to authorize link.

2. If you do not have administrator permissions, follow the instructions on screen and click Close.

The Microsoft 365 instance should now appear on the Data Sources screen under 3rd Party Data Sources.

Show markdown source

@@ -1,36 +0,0 @@
----
-description: Add Microsoft 365 as a Cortex XSIAM data source.
----
-
-# How to onboard Microsoft 365
-
-{% hint style="info" %}
-This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
-{% endhint %}
-
-You can add Microsoft 365 as a third-party data source in Cortex Cloud Data Security.
-
-{% hint style="warning" %}
-Prerequisites
-
-* You have generated a Globally Unique Identifier (GUID), also known as a Universally Unique Identifier (UUID). You will need this ID for the tenant you want to use for the Microsoft 365 instance.
-* To use Microsoft 365, you must be registered with Microsoft Azure.
-{% endhint %}
-
-**Configuration**
-
-1. Navigate to **Settings** → **Data Sources & Integrations**.
-2. On the **Data Sources & Integrations** page, click **+ Add New**.
-3. On the **Add Data Sources or Integrations** page, search for **Microsoft 365**, then hover over it and click **Add**.
-4. On the **Microsoft 365** integration instance settings page, do the following:
-   1. In the **Display Name** field, enter a name for your Microsoft 365 integration instance.
-   2. In the **Tenant ID** field, enter a tenant ID.
-   3. In the **Region** list, select a region.
-5. Click **Next**.
-
-**Authorization**
-
-1. On the **Microsoft 365 Instance** screen, if you are an administrator, click the **click to authorize** link.
-2. If you do not have administrator permissions, follow the instructions on screen and click **Close**.
-
-The **Microsoft 365** instance should now appear on the **Data Sources** screen under **3rd Party Data Sources**.

▸ How to onboard on-premise assets to Cloud Data Security deleted +0 −58 Deleted, along with its Activate DSPM Fileshare child; the two Broker VM applet pages cover on-premise data security instead.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/how-to-onboard-on-premise-assets-to-cloud-data-security

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,58 +0,0 @@

---

description: Onboard on-premise assets to Cloud Data Security with Cortex XSIAM.

---

# How to onboard on-premise assets to Cloud Data Security

hint info

The data sources are included in Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

endhint

The following applets enable you to monitor and secure assets residing in your on-premise environment:

• File share protection with the DSPM Fileshare applet: By activating the DSPM Fileshare applet, you extend security coverage to your physical infrastructure, enabling classification for SMB and NFS file shares. This allows you to automatically discover stored content, identify sensitive data, and locate shadow backups, ensuring continuous visibility and consistent governance across hybrid and legacy environments.

• Database visibility with the DSPM Database applet: The DSPM Database applet provides insights into risks associated with data stored in on-premise databases, PostgreSQL and MySQL instances. Whether you are transitioning to the cloud or maintaining assets on-premise, activating this applet offers a customizable way to manage data security and compliance within a single, unified platform.

To extend the capabilities of Cortex Cloud Data Security to your on-premise infrastructure, you use the Broker VM and a specialized application called an applet. The Broker VM is a virtual machine deployed within your local network that acts as a secure, local collector and gateway. It is essential for unifying and packaging data from your on-premise resources before sending them to Cloud Data Security.

For information about working with Broker VM, see What is the Broker VM?.

hint info

### Note

Your data is scanned on the Broker VM itself, and only the metadata and classification results are transmitted from the on-premise environment to Cortex XSIAM.

endhint

DSPM Fileshare applet

The DSPM Fileshare applet is an application installed directly onto the Broker VM. The applet’s primary role is to establish and manage connections with your on-premise network file shares, including those using the SMB (Server Message Block) and NFS (Network File Sharing) protocols.

Once configured, this applet continuously:

• Accesses the designated file share paths.

• Ingests the file and folder metadata.

• Classifies files and identifies sensitive information.

• Transmits the collected metadata and results securely through the Broker VM to Cortex XSIAM.

hint info

### Note

For information about activating the DSPM Fileshare applet, see Activate DSPM Fileshare.

endhint

DSPM Database applet

The DSPM Database applet is an application installed directly onto the Broker VM. It is the core component responsible for auditing and securing your on-premises PostgreSQL and MySQL databases, providing visibility into the risks associated with your stored data.

Once configured, this applet continuously:

• Accesses your on-premise databases, including those containing regulated or confidential information.

• Identifies data that must be stored in accordance with specific compliance standards.

• Classifies database content to identify sensitive information.

• Transmits the collected insights and risk metadata securely through the Broker VM to Cortex Cloud Data Security.

hint info

### Note

For information about activating the DSPM Database applet, see Activate DSPM Database.

endhint

Show markdown source

@@ -1,58 +0,0 @@
----
-description: Onboard on-premise assets to Cloud Data Security with Cortex XSIAM.
----
-
-# How to onboard on-premise assets to Cloud Data Security
-
-{% hint style="info" %}
-The data sources are included in Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
-{% endhint %}
-
-The following applets enable you to monitor and secure assets residing in your on-premise environment:
-
-* **File share protection with the DSPM Fileshare applet**: By activating the **DSPM Fileshare** applet, you extend security coverage to your physical infrastructure, enabling classification for SMB and NFS file shares. This allows you to automatically discover stored content, identify sensitive data, and locate shadow backups, ensuring continuous visibility and consistent governance across hybrid and legacy environments.
-* **Database visibility with the DSPM Database applet**: The **DSPM Database** applet provides insights into risks associated with data stored in on-premise databases, PostgreSQL and MySQL instances. Whether you are transitioning to the cloud or maintaining assets on-premise, activating this applet offers a customizable way to manage data security and compliance within a single, unified platform.
-
-To extend the capabilities of Cortex Cloud Data Security to your on-premise infrastructure, you use the Broker VM and a specialized application called an applet. The Broker VM is a virtual machine deployed within your local network that acts as a secure, local collector and gateway. It is essential for unifying and packaging data from your on-premise resources before sending them to Cloud Data Security.
-
-For information about working with Broker VM, see [What is the Broker VM?](../../data-management/broker-vm/what-is-the-broker-vm).
-
-{% hint style="info" %}
-### Note
-
-Your data is scanned on the Broker VM itself, and only the metadata and classification results are transmitted from the on-premise environment to Cortex XSIAM.
-{% endhint %}
-
-**DSPM Fileshare applet**
-
-The **DSPM Fileshare** applet is an application installed directly onto the Broker VM. The applet’s primary role is to establish and manage connections with your on-premise network file shares, including those using the SMB (Server Message Block) and NFS (Network File Sharing) protocols.
-
-Once configured, this applet continuously:
-
-* Accesses the designated file share paths.
-* Ingests the file and folder metadata.
-* Classifies files and identifies sensitive information.
-* Transmits the collected metadata and results securely through the Broker VM to Cortex XSIAM.
-
-{% hint style="info" %}
-### Note
-
-For information about activating the **DSPM Fileshare** applet, see [Activate DSPM Fileshare](../generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-fileshare).
-{% endhint %}
-
-**DSPM Database applet**
-
-The **DSPM Database** applet is an application installed directly onto the Broker VM. It is the core component responsible for auditing and securing your on-premises PostgreSQL and MySQL databases, providing visibility into the risks associated with your stored data.
-
-Once configured, this applet continuously:
-
-* Accesses your on-premise databases, including those containing regulated or confidential information.
-* Identifies data that must be stored in accordance with specific compliance standards.
-* Classifies database content to identify sensitive information.
-* Transmits the collected insights and risk metadata securely through the Broker VM to Cortex Cloud Data Security.
-
-{% hint style="info" %}
-### Note
-
-For information about activating the **DSPM Database** applet, see Activate DSPM Database.
-{% endhint %}

▸ Activate DSPM Fileshare deleted +0 −65 Deleted; the Broker VM applet page of the same name is now canonical.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/how-to-onboard-on-premise-assets-to-cloud-data-security/activate-dspm-fileshare

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,65 +0,0 @@

---

description: Activate the DSPM Fileshare applet on a Broker VM in Cortex XSIAM.

---

# Activate DSPM Fileshare

hint info

The data sources are included in the Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

endhint

hint info

Prerequisites:

• Set up and configure Broker VM

• Know the complete path to the files and folders that you want Cortex XSIAM to monitor.

• Necessary user permissions to access the network shares. For the SMB connection type, you need the username and password.

endhint

1. Select Settings → Configurations → Data Broker → Broker VMs.

2. On the Brokers tab, find Broker VM, and in the APPS column, click + ADD. In the list of applets, click DSPM Fileshare.

The applet list displays only the applets for which you have permissions.

3. Configure the DSPM Fileshare settings according to the following steps.

**File Share Connection**

Field│Description

    | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Connection Type│

NFS (Network File System): A distributed file system protocol that lets networked computers share files remotely, making them appear as if they're stored locally. Operating at the application layer, it uses Remote Procedure Calls (RPCs) for clients to access a server's files and directories.
SMB (Server Message Block): A network file-sharing protocol that provides shared access to resources like files, printers, and serial ports across a network. It enables client applications to remotely interact with files and other assets stored on a server. It is the default file-sharing protocol for Microsoft Windows operating systems. This connection type requires a username and a password.

Path│Specify the host and path to the folder containing the files that you want Cortex Cloud Data Security to monitor.

Username│For the SMB connection type only.

Password│For the SMB connection type only.

Test Connection│Select to validate the connection permissions.

By default, all configured connections are saved.

4. On the File Share Connection screen, click + Add a Connection.

For details regarding the connection fields, see the table above under File Share Connection.

5. In the File Share Connection field, replace the text with a name for the new connection.

6. Select a connection type.

7. Provide the path to the shared folder (the host and path).

8. For SMB connections only, provide a username and password.

9. Optionally, do the following:

1. Turn on the Classification toggle. This enables 2,500 random files to be scanned and classified each time.

2. In the Scan every list, select the cadence of how often the files are to be scanned. If you want the scans to occur less frequently, choose the Custom option and enter the number of days, weeks, or months that you require.

10. Click Test Connection to ensure the connection works properly.

11. Click Save.

hint info

You can add multiple connections under a single instance of the DSPM Fileshare applet by returning to the File Share Connection screen and clicking Add Connection. Each new connection can be of either the NFS or SMB connection type.

endhint

Other actions

Once the DSPM Fileshare applet is activated, you can perform the following actions:

• Edit

• Deactivate: On the Broker VMs screen, in the ADD column, in the context menu, click Deactivate.

• Delete: On the File Share Connection screen, click the Delete icon next to the connection you want to remove.

Inventory list

Each new connection that is created correlates to an asset in the inventory. You can see the connections by clicking Inventory → All Assets → Data → Storage Buckets.

Show markdown source

@@ -1,65 +0,0 @@
----
-description: Activate the DSPM Fileshare applet on a Broker VM in Cortex XSIAM.
----
-
-# Activate DSPM Fileshare
-
-{% hint style="info" %}
-The data sources are included in the Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
-{% endhint %}
-
-{% hint style="info" %}
-Prerequisites:
-
-* [Set up and configure Broker VM](../../../data-management/broker-vm/set-up-and-configure-broker-vm)
-* Know the complete path to the files and folders that you want Cortex XSIAM to monitor.
-* Necessary user permissions to access the network shares. For the SMB connection type, you need the username and password.
-{% endhint %}
-
-1. Select Settings → Configurations → Data Broker → Broker VMs.
-2.  On the Brokers tab, find Broker VM, and in the APPS column, click + ADD. In the list of applets, click DSPM Fileshare.
-
-    The applet list displays only the applets for which you have permissions.
-3.  Configure the DSPM Fileshare settings according to the following steps.
-
-    **File Share Connection**
-
-    | Field           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-    | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-    | Connection Type | <ul><li><strong>NFS (Network File System):</strong> A distributed file system protocol that lets networked computers share files remotely, making them appear as if they're stored locally. Operating at the application layer, it uses Remote Procedure Calls (RPCs) for clients to access a server's files and directories.</li><li><strong>SMB (Server Message Block):</strong> A network file-sharing protocol that provides shared access to resources like files, printers, and serial ports across a network. It enables client applications to remotely interact with files and other assets stored on a server. It is the default file-sharing protocol for Microsoft Windows operating systems. This connection type requires a username and a password.</li></ul> |
-    | Path            | Specify the host and path to the folder containing the files that you want Cortex Cloud Data Security to monitor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-    | Username        | For the SMB connection type only.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-    | Password        | For the SMB connection type only.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-    | Test Connection | Select to validate the connection permissions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-
-    By default, all configured connections are saved.
-4.  On the File Share Connection screen, click + Add a Connection.
-
-    For details regarding the connection fields, see the table above under File Share Connection.
-5. In the File Share Connection field, replace the text with a name for the new connection.
-6. Select a connection type.
-7. Provide the path to the shared folder (the host and path).
-8. For SMB connections only, provide a username and password.
-9. Optionally, do the following:
-   1. Turn on the Classification toggle. This enables 2,500 random files to be scanned and classified each time.
-   2. In the Scan every list, select the cadence of how often the files are to be scanned. If you want the scans to occur less frequently, choose the Custom option and enter the number of days, weeks, or months that you require.
-10. Click Test Connection to ensure the connection works properly.
-11. Click Save.
-
-{% hint style="info" %}
-You can add multiple connections under a single instance of the DSPM Fileshare applet by returning to the File Share Connection screen and clicking Add Connection. Each new connection can be of either the NFS or SMB connection type.
-{% endhint %}
-
-**Other actions**
-
-Once the DSPM Fileshare applet is activated, you can perform the following actions:
-
-* Edit
-* **Deactivate:** On the Broker VMs screen, in the ADD column, in the context menu, click Deactivate.
-* **Delete:** On the File Share Connection screen, click the Delete icon next to the connection you want to remove.
-
-**Inventory list**
-
-Each new connection that is created correlates to an asset in the inventory. You can see the connections by clicking Inventory → All Assets → Data → Storage Buckets.
-
-<br>

▸ How to onboard Snowflake deleted +0 −62 Deleted; the copy under the Snowflake vendor page is now the only one.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/how-to-onboard-snowflake

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,62 +0,0 @@

---

description: Add Snowflake as a Cortex XSIAM data source.

---

# How to onboard Snowflake

## How to onboard Snowflake

hint info

This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

endhint

Integrate Cloud Data Security with your Snowflake account to gain comprehensive visibility into any data and posture risk existing in your Snowflake environment. This integration enables automated scanning of all assets in Snowflake, including data classification and risk assessment.

You can add Snowflake as a third-party data source in Cloud Data Security.

hint warning

### Prerequisite

• To use Snowflake, you must be registered with one of these cloud providers: Amazon AWS, Microsoft Azure, or Google Cloud Platform (GCP).

• Ensure you have the necessary account permissions to onboard. It is recommended to use Account Admin as the role for the onboarding.

endhint

Configuration Step

1. Navigate to Settings → Data Sources & Integrations.

2. On the Data Sources & Integrations page, click + Add New.

3. On the Add Data Sources or Integrations page, search for Snowflake, then hover over it and click Add.

4. On the New Data Source Snowflake integration instance settings page, do the following:

1. Enter a display name for your Snowflake integration instance.

2. Enter a Data Sharing Account Identifier.

       <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>The account identifier can be found using the user information at the bottom left. Hover over the account you wish to onboard and select the copy option at the top right. The account identifier is usually of the format:</p><p>(organization).[account]</p></div>

3. (Optional) If you have a Snowflake account that is protected by a network policy, turn on the My Snowflake account is protected by network policies toggle button. The network policies are related to the IP allow list.

4. Select a cloud platform and choose a region.

5. (Optional) If you want to use an existing user:

1. Click Show advance settings and then turn on the Use an existing user toggle button.

2. Enter the user name and the login name.

5. Click Next.

Establish Connection Step

1. Open your Snowflake console in a new tab.

2. Using the copy or download icons, copy or download the script in the Generated script text box and paste it into a new worksheet in Snowflake.

3. Select the entire script and select Run all.

4. Once the script runs without errors, come back to the Snowflake screen and click Verify Connection to check if the instance is detected.

Verify Connection Step

1. A success or failure message appears on the screen.

2. If a success message appears, you can do the following:

• View the instance's information in the Snowflake Posture instances.

• View the assets in Asset Inventory, once the first scan is complete.

Delete a Snowflake instance

1. Navigate to Settings → Data Sources & Integrations.

2. On the Data Sources & Integrations page, select the Snowflake integration or filter to search for it and then select it.

3. On the Snowflake page, right click the row of the integration instance you want to delete.

4. From the drop down menu, select Settings and from the integration instance settings page select the Delete checkbox and then click Delete.

The Snowflake instance is now removed, including all previous scans.

Show markdown source

@@ -1,62 +0,0 @@
----
-description: Add Snowflake as a Cortex XSIAM data source.
----
-
-# How to onboard Snowflake
-
-## How to onboard Snowflake
-
-{% hint style="info" %}
-This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
-{% endhint %}
-
-Integrate Cloud Data Security with your Snowflake account to gain comprehensive visibility into any data and posture risk existing in your Snowflake environment. This integration enables automated scanning of all assets in Snowflake, including data classification and risk assessment.
-
-You can add Snowflake as a third-party data source in Cloud Data Security.
-
-{% hint style="warning" %}
-### Prerequisite
-
-* To use Snowflake, you must be registered with one of these cloud providers: Amazon AWS, Microsoft Azure, or Google Cloud Platform (GCP).
-* Ensure you have the necessary account permissions to onboard. It is recommended to use Account Admin as the role for the onboarding.
-{% endhint %}
-
-**Configuration Step**
-
-1. Navigate to **Settings** → **Data Sources & Integrations**.
-2. On the **Data Sources & Integrations** page, click **+ Add New**.
-3. On the **Add Data Sources or Integrations** page, search for **Snowflake**, then hover over it and click **Add**.
-4. On the **New Data Source** Snowflake integration instance settings page, do the following:
-   1. Enter a display name for your Snowflake integration instance.
-   2.  Enter a Data Sharing Account Identifier.
-
-       <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>The account identifier can be found using the user information at the bottom left. Hover over the account you wish to onboard and select the copy option at the top right. The account identifier is usually of the format:</p><p>(organization).[account]</p></div>
-   3. (Optional) If you have a Snowflake account that is protected by a network policy, turn on the **My Snowflake account is protected by network policies** toggle button. The network policies are related to the IP allow list.
-   4. Select a cloud platform and choose a region.
-   5. (Optional) If you want to use an existing user:
-      1. Click **Show advance settings** and then turn on the **Use an existing user** toggle button.
-      2. Enter the user name and the login name.
-5. Click **Next**.
-
-**Establish Connection Step**
-
-1. Open your Snowflake console in a new tab.
-2. Using the copy or download icons, copy or download the script in the **Generated script** text box and paste it into a new worksheet in Snowflake.
-3. Select the entire script and select **Run all**.
-4. Once the script runs without errors, come back to the **Snowflake** screen and click **Verify Connection** to check if the instance is detected.
-
-**Verify Connection Step**
-
-1. A success or failure message appears on the screen.
-2. If a success message appears, you can do the following:
-   * View the instance's information in the Snowflake Posture instances.
-   * View the assets in Asset Inventory, once the first scan is complete.
-
-**Delete a Snowflake instance**
-
-1. Navigate to **Settings** → **Data Sources & Integrations**.
-2. On the **Data Sources & Integrations** page, select the **Snowflake** integration or filter to search for it and then select it.
-3. On the **Snowflake** page, right click the row of the integration instance you want to delete.
-4.  From the drop down menu, select **Settings** and from the integration instance settings page select the **Delete** checkbox and then click **Delete**.
-
-    The Snowflake instance is now removed, including all previous scans.

▸ Ingest logs and data from Okta deleted +0 −88 Deleted; the copy under the Okta vendor page is now the only one.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources/ingest-logs-and-data-from-okta

Read it on the Cortex docs portal ↗ This file's diff on GitHub ↗

Before After

@@ -1,88 +0,0 @@

---

description: Configure Okta log and configuration data ingestion for Cortex XSIAM.

---

# Ingest logs and data from Okta

### Product availability and licensing

The options available in the UI depend on your specific product license:

• Collect logs: Available for all Cortex XSIAM licenses

• Collect Configuration. Available for Cortex XSIAM, Cloud Posture Security, or Cloud Runtime Security licenses.

Feature│Cortex XSIAM NG SIEM, Cortex XSIAM Enterprise, and Cortex XSIAM Premium│Cortex XSIAM Enterprise Plus

| --------------------- | ----------------------------------------------------------------------- | ---------------------------- |

Collect Logs│Enabled│Enabled

Collect Configuration│Enabled with Cloud Posture Security or Cloud Runtime Security add-on│Disabled

hint warning

### Prerequisite

Administrator privileges: Your Okta user must have a role capable of creating API tokens, such as Read-only Administrator, Super Administrator, or Organization Administrator. For more information, see the Okta Administrators Documentation.

endhint

To receive logs and configuration data from Okta, configure the Data Sources & Integrations settings in Cortex XSIAM. Once enabled, the system immediately begins ingesting activity logs and identity configuration metadata, according to your configuration settings.

Activity logs are searchable in the okta_sso_raw dataset and normalized to xdr_data or saas_audit_logs.

When enabled with a Cloud Posture Security or Cloud Runtime Security add-on, activity logs are also searchable using advanced Identity Security queries using Cortex Query Language (XQL). For more information, see Perform advanced Identity Security investigations using XQL.

• Activity logs are also searchable using advanced Identity Security queries using Cortex Query Language (XQL). For more information, see Perform advanced Identity Security investigations using XQL.

• Configuration data is used for Identity Security visibility and is searchable in Identity Security → Identity Asset Inventory and using the ciem_permissions_with_last_access dataset.

### API rate limits and monitoring

The Okta API enforces concurrent rate limits. To prevent service disruption:

• The Okta data collector includes a mechanism that automatically reduces the number of requests whenever an error is received from the Okta API indicating that too many requests have already been sent.

• To ensure you are notified when this occurs, an alert is displayed in the Notification Area, and a record is added to the Management Audit Logs.

### How to configure the Okta collection?

#### Step 1: Configure Okta for integration

Perform these steps in your Okta Admin Console to prepare for the connection.

1. Identify your Okta Domain:

1. From the Okta Dashboard, click the down arrow under your name in the top-right corner.

2. Copy the Org URL, such as https://example.okta.com, and save it for the Okta Domain field in Cortex XSIAM.

    For more information, see the [Okta Documentation](https://developer.okta.com/docs/guides/find-your-domain/findorg/).

2. Obtain your authentication token in Okta:

1. Select Security → API → Tokens, and click Create token.

2. Set the following parameters for the token:

• What do you want your token to be named?: Specify the name for your token, which is used for tracking API calls.

• API calls made with this token must originate from: Select Any IP.

3. Click Create token. You may need to log inlogin to Okta again using your MFA administrator credentials.

4. Your token is successfully created. Copy the Token Value and record it immediately. You will need this for the TOKEN field in Cortex XSIAM. Once you close the dialog box by clicking Ok, got it, you won't be able to access the token again and will have to create a new one if you didn't record it.

#### Step 2: Configure the Okta Collector in Cortex XSIAM

1. Select Settings → Data Sources & Integrations.

2. On the Data Sources & Integrations page, click + Add New, search for Okta, then hover over it and click Add.

3. Integrate the Okta authentication service with Cortex XSIAM:

1. Enter the Okta Domain (Org URL) and Token obtained in Step 1.

2. Collect Logs: Select this option to ingest activity logs.

3. (Optional) Define an Event Filter to configure collection for events of your choosing.

• All events are collected by default unless you define an Okta API Filter expression, such as filter=eventType eq “user.session.start”.

• For Okta information to be woven into authentication stories, “user.authentication.sso” events must be collected.

4. Collect Configuration: Select this option to provide deep visibility into identities and permissions, offering comprehensive insights into users, user groups, and applications. It specifically highlights the permissions granted to Okta users in cloud environments, centralizing group memberships to secure your identity landscape.

5. Test the connection.

6. Click Enable.

#### Step 3. Accessing the data

Data is routed differently depending on which collection option is enabled:

Activity Data (using Collect Logs)

• XQL: Searchable using the okta_sso_raw dataset.

• Normalization: Depending on the event type, data is normalized to either xdr_data or saas_audit_logs datasets.

• Enabled with a Cloud Posture Security or Cloud Runtime Security add-on: Searchable using advanced Identity Security queries using Cortex Query Language (XQL). For more information, see Perform advanced Identity Security investigations using XQL.

Configuration data (using Collect Configuration)

• Identity inventory: Access the data in the Identity Asset Inventory within the Cortex Cloud Identity Security module (Identity Security → Identity Asset Inventory).

• XQL: Use the following dataset for CIEM (Cloud Infrastructure Entitlements Management) visibility: ciem_permissions_with_last_access

Show markdown source

@@ -1,88 +0,0 @@
----
-description: Configure Okta log and configuration data ingestion for Cortex XSIAM.
----
-
-# Ingest logs and data from Okta
-
-### Product availability and licensing
-
-The options available in the UI depend on your specific product license:
-
-* Collect logs: Available for all Cortex XSIAM licenses
-* Collect Configuration. Available for Cortex XSIAM, Cloud Posture Security, or Cloud Runtime Security licenses.
-
-| Feature               | Cortex XSIAM NG SIEM, Cortex XSIAM Enterprise, and Cortex XSIAM Premium | Cortex XSIAM Enterprise Plus |
-| --------------------- | ----------------------------------------------------------------------- | ---------------------------- |
-| Collect Logs          | Enabled                                                                 | Enabled                      |
-| Collect Configuration | Enabled with Cloud Posture Security or Cloud Runtime Security add-on    | Disabled                     |
-
-{% hint style="warning" %}
-### Prerequisite
-
-**Administrator privileges**: Your Okta user must have a role capable of creating API tokens, such as Read-only Administrator, Super Administrator, or Organization Administrator. For more information, see the [Okta Administrators Documentation](https://help.okta.com/en-us/Content/Topics/Security/Administrators.htm?cshid=ext_Security_Administrators).
-{% endhint %}
-
-To receive logs and configuration data from Okta, configure the **Data Sources & Integrations** settings in Cortex XSIAM. Once enabled, the system immediately begins ingesting activity logs and identity configuration metadata, according to your configuration settings.
-
-Activity logs are searchable in the `okta_sso_raw` dataset and normalized to `xdr_data` or `saas_audit_logs`.
-
-When enabled with a Cloud Posture Security or Cloud Runtime Security add-on, activity logs are also searchable using advanced Identity Security queries using Cortex Query Language (XQL). For more information, see [Perform advanced Identity Security investigations using XQL](../../../cloud-security/cortex-cloud-identity-security/perform-advanced-identity-security-investigations-using-xql).
-
-* Activity logs are also searchable using advanced Identity Security queries using Cortex Query Language (XQL). For more information, see [Perform advanced Identity Security investigations using XQL](../../../cloud-security/cortex-cloud-identity-security/perform-advanced-identity-security-investigations-using-xql).
-* Configuration data is used for Identity Security visibility and is searchable in **Identity Security** → **Identity Asset Inventory** and using the `ciem_permissions_with_last_access` dataset.
-
-### API rate limits and monitoring
-
-The Okta API enforces concurrent rate limits. To prevent service disruption:
-
-* The Okta data collector includes a mechanism that automatically reduces the number of requests whenever an error is received from the Okta API indicating that too many requests have already been sent.
-* To ensure you are notified when this occurs, an alert is displayed in the Notification Area, and a record is added to the Management Audit Logs.
-
-### How to configure the Okta collection?
-
-#### Step 1: Configure Okta for integration
-
-Perform these steps in your Okta Admin Console to prepare for the connection.
-
-1.  Identify your Okta Domain:
-
-    1. From the Okta Dashboard, click the down arrow under your name in the top-right corner.
-    2. Copy the Org URL, such as `https://example.okta.com`, and save it for the Okta Domain field in Cortex XSIAM.
-
-    For more information, see the [Okta Documentation](https://developer.okta.com/docs/guides/find-your-domain/findorg/).
-2. Obtain your authentication token in Okta:
-   1. Select Security → API → Tokens, and click Create token.
-   2. Set the following parameters for the token:
-      * What do you want your token to be named?: Specify the name for your token, which is used for tracking API calls.
-      * API calls made with this token must originate from: Select Any IP.
-   3. Click Create token. You may need to log inlogin to Okta again using your MFA administrator credentials.
-   4. Your token is successfully created. Copy the Token Value and record it immediately. You will need this for the TOKEN field in Cortex XSIAM. Once you close the dialog box by clicking Ok, got it, you won't be able to access the token again and will have to create a new one if you didn't record it.
-
-#### Step 2: Configure the Okta Collector in Cortex XSIAM
-
-1. Select Settings → Data Sources & Integrations.
-2. On the Data Sources & Integrations page, click + Add New, search for Okta, then hover over it and click Add.
-3. Integrate the Okta authentication service with Cortex XSIAM:
-   1. Enter the Okta Domain (Org URL) and Token obtained in Step 1.
-   2. Collect Logs: Select this option to ingest activity logs.
-   3. (Optional) Define an Event Filter to configure collection for events of your choosing.
-      * All events are collected by default unless you define an Okta API Filter expression, such as `filter=eventType eq “user.session.start”`.
-      * For Okta information to be woven into authentication stories, `“user.authentication.sso”` events must be collected.
-   4. Collect Configuration: Select this option to provide deep visibility into identities and permissions, offering comprehensive insights into users, user groups, and applications. It specifically highlights the permissions granted to Okta users in cloud environments, centralizing group memberships to secure your identity landscape.
-   5. Test the connection.
-   6. Click Enable.
-
-#### Step 3. Accessing the data
-
-Data is routed differently depending on which collection option is enabled:
-
-Activity Data (using Collect Logs)
-
-* **XQL**: Searchable using the `okta_sso_raw` dataset.
-* **Normalization**: Depending on the event type, data is normalized to either `xdr_data` or `saas_audit_logs` datasets.
-* **Enabled with a Cloud Posture Security or Cloud Runtime Security add-on**: Searchable using advanced Identity Security queries using Cortex Query Language (XQL). For more information, see Perform advanced Identity Security investigations using XQL.
-
-Configuration data (using Collect Configuration)
-
-* **Identity inventory**: Access the data in the Identity Asset Inventory within the Cortex Cloud Identity Security module (Identity Security → Identity Asset Inventory).
-* **XQL**: Use the following dataset for CIEM (Cloud Infrastructure Entitlements Management) visibility: `ciem_permissions_with_last_access`

▸ Activate DSPM Database added +67 −0 New page: the DSPM Database applet audits on-premise PostgreSQL and MySQL, with a connection table, a scan cadence, and an inventory entry under All Assets → Data → Databases.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-database

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -0,0 +1,67 @@

# Activate DSPM Database

hint info

License

This feature is included with a Cortex XSIAM Premium license. It is also included with a Cortex XSIAM NG SIEM and Cortex XSIAM Enterprise license that has the Cloud Posture Security or Cloud Runtime Security add-on.

endhint

The DSPM Database applet is an application installed directly onto the Broker VM. It is the core component responsible for auditing and securing your on-premises PostgreSQL and MySQL databases, providing visibility into the risks associated with your stored data.

Once configured, this applet continuously:

• Accesses your on-premise databases, including those containing regulated or confidential information.

• Identifies data that must be stored in accordance with specific compliance standards.

• Classifies database content to identify sensitive information.

• Transmits the collected insights and risk metadata securely through the Broker VM to Cortex XSIAM.

The DSPM Database applet provides insights into risks associated with data stored in on-premise databases, PostgreSQL and MySQL instances. Whether you are transitioning to the cloud or maintaining assets on-premise, activating this applet offers a customizable way to manage data security and compliance within a single, unified platform.

hint warning

Prerequisite

• Set up and configure Broker VM.

• Know the database engine, host, and port for the database you want to connect.

endhint

### How to activate the DSPM Database applet

1. Select Settings → Configurations → Data Broker → Broker VMs.

2. Do one of the following:

• On the Brokers tab, find the Broker VM, and in the APPS column, left-click Add → DSPM Database.

• On the Clusters tab, find the Broker VM, and in the APPS column, left-click Add → DSPM Database.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The applet list displays only the applets for which you have permissions.</p></div>

3. Configure the DSPM Database settings.\

**Database Connection**

Field│Description

    | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Database Engine│Select PostgreSQL or MySQL in the list.

Host│Enter host name.

Port│Enter port.

Database Name│Enter the name of the database.

Enable SSL│Decide whether to turn on the Enable SSL toggle, which ensures that the connection between the applet and your on-premise database is encrypted, protecting data in transit.

Username│Enter your user name.

Password│Enter your password.

Test Connection│Select to validate the connection permissions.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>By default, all configured connections are saved.</p></div>

4. (Optional) Click Add Connection to define another database connection. You can add multiple connections under one DSPM Database applet instance.

5. Activate the DSPM Database applet.\

After a successful activation, the APPS field displays DSPM Database with a green dot indicating a successful connection.

### Other actions

Once the DSPM Database applet is activated, you can perform the following actions:

• Edit

• Deactivate: On the Broker VMs screen, in the ADD column, in the context menu, click Deactivate.

• Delete: On the Database Connection screen, click the Delete icon next to the connection you want to remove.

• Scan: Turn on the Classification toggle. This enables 2.500 random files to be scanned classified each time.

• Select Cadence: In the Scan every list, select the cadence of how often the files are to be scanned. If you want the scans to occur less frequently, choose the Custom option and enter the amount of days, weeks, or months that you require.

### Inventory list

Each new connection that is created correlates to an asset in the inventory. You can see the connections by clicking Inventory → All Assets → Data → Databases. Make sure to set the filter to Provider = On Premise.

Show markdown source

@@ -0,0 +1,67 @@
+# Activate DSPM Database
+
+{% hint style="info" %}
+**License**
+
+This feature is included with a Cortex XSIAM Premium license. It is also included with a Cortex XSIAM NG SIEM and Cortex XSIAM Enterprise license that has the Cloud Posture Security or Cloud Runtime Security add-on.
+{% endhint %}
+
+The DSPM Database applet is an application installed directly onto the Broker VM. It is the core component responsible for auditing and securing your on-premises PostgreSQL and MySQL databases, providing visibility into the risks associated with your stored data.
+
+Once configured, this applet continuously:
+
+* Accesses your on-premise databases, including those containing regulated or confidential information.
+* Identifies data that must be stored in accordance with specific compliance standards.
+* Classifies database content to identify sensitive information.
+* Transmits the collected insights and risk metadata securely through the Broker VM to Cortex XSIAM.
+
+The DSPM Database applet provides insights into risks associated with data stored in on-premise databases, PostgreSQL and MySQL instances. Whether you are transitioning to the cloud or maintaining assets on-premise, activating this applet offers a customizable way to manage data security and compliance within a single, unified platform.
+
+{% hint style="warning" %}
+**Prerequisite**
+
+* [Set up and configure Broker VM](broken-reference).
+* Know the database engine, host, and port for the database you want to connect.
+{% endhint %}
+
+### How to activate the DSPM Database applet
+
+1. Select **Settings** → **Configurations** → **Data Broker** → **Broker VMs**.
+2.  Do one of the following:
+
+    * On the **Brokers** tab, find the Broker VM, and in the **APPS** column, left-click **Add** → **DSPM Database**.
+    * On the **Clusters** tab, find the Broker VM, and in the **APPS** column, left-click **Add** → **DSPM Database**.
+
+    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The applet list displays only the applets for which you have permissions.</p></div>
+3.  Configure the **DSPM Database** settings.\
+    **Database Connection**
+
+    | Field           | Description                                                                                                                                                                      |
+    | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+    | Database Engine | Select **PostgreSQL** or **MySQL** in the list.                                                                                                                                  |
+    | Host            | Enter host name.                                                                                                                                                                 |
+    | Port            | Enter port.                                                                                                                                                                      |
+    | Database Name   | Enter the name of the database.                                                                                                                                                  |
+    | Enable SSL      | Decide whether to turn on the **Enable SSL** toggle, which ensures that the connection between the applet and your on-premise database is encrypted, protecting data in transit. |
+    | Username        | Enter your user name.                                                                                                                                                            |
+    | Password        | Enter your password.                                                                                                                                                             |
+    | Test Connection | Select to validate the connection permissions.                                                                                                                                   |
+
+    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>By default, all configured connections are saved.</p></div>
+4. (Optional) Click **Add Connection** to define another database connection. You can add multiple connections under one DSPM Database applet instance.
+5. Activate the DSPM Database applet.\
+   After a successful activation, the **APPS** field displays DSPM Database with a green dot indicating a successful connection.
+
+### Other actions
+
+Once the DSPM Database applet is activated, you can perform the following actions:
+
+* **Edit**
+* **Deactivate**: On the **Broker VMs** screen, in the **ADD** column, in the context menu, click **Deactivate**.
+* **Delete**: On the **Database Connection** screen, click the **Delete** icon next to the connection you want to remove.
+* **Scan**: Turn on the **Classification** toggle. This enables 2.500 random files to be scanned classified each time.
+* **Select Cadence**: In the **Scan every** list, select the cadence of how often the files are to be scanned. If you want the scans to occur less frequently, choose the Custom option and enter the amount of days, weeks, or months that you require.
+
+### Inventory list
+
+Each new connection that is created correlates to an asset in the inventory. You can see the connections by clicking **Inventory** → **All Assets** → **Data** → **Databases**. Make sure to set the filter to `Provider = On Premise`.

▸ Activate DSPM Fileshare modified +29 −27 Adds an overview of what the applet does, folds Classification and scan cadence into the settings table, and drops the eleven-step connection walkthrough.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-fileshare

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -5,61 +5,63 @@ description: Configure this data source for Cortex XSIAM.

# Activate DSPM Fileshare

hint info

License

This feature is included with a Cortex XSIAM Premium license. It is also included with a Cortex XSIAM NG SIEM and Cortex XSIAM Enterprise license that has the Cloud Posture Security or Cloud Runtime Security add-on.

endhint

The DSPM Fileshare applet is an application installed directly onto the Broker VM. The applet’s primary role is to establish and manage connections with your on-premise network file shares, including those using the SMB (Server Message Block) and NFS (Network File Sharing) protocols.

Once configured, this applet continuously:

• Accesses the designated file share paths.

• Ingests the file and folder metadata.

• Classifies files and identifies sensitive information.

• Transmits the collected metadata and results securely through the Broker VM to Cortex XSIAM.

By activating the DSPM Fileshare applet, you extend security coverage to your physical infrastructure, enabling classification for SMB and NFS file shares. This allows you to automatically discover stored content, identify sensitive data, and locate shadow backups, ensuring continuous visibility and consistent governance across hybrid and legacy environments.

hint warning

Prerequisite

• Set up and configure Broker VM

• Know the complete path to the files and folders that you want Cortex XSIAM to monitor.

• Necessary user permissions to access the network shares. For the SMB connection type, you need the user name and password.

endhint

### How to activate the DSPM Fileshare applet

1. Select Settings → Configurations → Data Broker → Broker VMs.

2. On the Brokers tab, find Broker VM, and in the APPS column, click + ADD. In the list of applets, click DSPM Fileshare.

2. Do one of the following:

• On the Brokers tab, find the Broker VM, and in the APPS column, left-click Add → DSPM Fileshare.

• On the Clusters tab, find the Broker VM, and in the APPS column, left-click Add → DSPM Fileshare.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The applet list displays only the applets for which you have permissions.</p></div>

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The applet list displays only the applets for which you have permissions.</p></div>

3. Configure the DSPM Fileshare settings according to the following steps.

3. Configure the DSPM Fileshare settings.

#### File Share Connection

Field│Description

    | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

    | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Connection Type│* NFS (Network File System): A distributed file system protocol that lets networked computers share files remotely, making them appear as if they're stored locally. Operating at the application layer, it uses Remote Procedure Calls (RPCs) for clients to access a server's files and directories.

* SMB (Server Message Block): A network file-sharing protocol that provides shared access to resources like files, printers, and serial ports across a network. It enables client applications to remotely interact with files and other assets stored on a server. It is the default file-sharing protocol for Microsoft Windows operating systems. This connection type requires a username and a password.

File Share Connection│Replace the text with a name for the new connection.

Path│Specify the host and path to the folder containing the files that you want Cortex Cloud Data Security to monitor.

Connection Type│* NFS (Network File System): A distributed file system protocol that lets networked computers share files remotely, making them appear as if they're stored locally. Operating at the application layer, it uses Remote Procedure Calls (RPCs) for clients to access a server's files and directories.

* SMB (Server Message Block): A network file-sharing protocol that provides shared access to resources like files, printers, and serial ports across a network. It enables client applications to remotely interact with files and other assets stored on a server. It is the default file-sharing protocol for Microsoft Windows operating systems. This connection type requires a username and a password.

Username│For the SMB connection type only.

Path│Specify the host and path to the folder containing the files that you want Cortex XSIAM to monitor.

Password│For the SMB connection type only.

Username│For the SMB connection type only.

Test Connection│Select to validate the connection permissions.

Password│For the SMB connection type only.

Classification│Decide whether to turn on the Classification toggle. This enables 2,500 random files to be scanned and classified each time.

Scan every│Select the cadence of how often the files are to be scanned. If you want the scans to occur less frequently, choose the Custom option and enter the amount of days, weeks, or months that you require.

Test Connection│Select to validate the connection permissions.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>By default, all configured connections are saved.</p></div>

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>By default, all configured connections are saved.</p></div>

4. On the File Share Connection screen, click + Add a Connection.

4. (Optional) Click Add Connection to define another database connection. You can add multiple connections under one DSPM Fileshare applet instance.

5. Activate the DSPM Fileshare applet.\

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>For details regarding the connection fields, see the table above under File Share Connection.</p></div>

After a successful activation, the APPS field displays DSPM Fileshare with a green dot indicating a successful connection.

5. In the File Share Connection field, replace the text with a name for the new connection.

6. Select a connection type.

7. Provide the path to the shared folder (the host and path).

8. For SMB connections only, provide a username and password.

9. Optionally, do the following:

1. Turn on the Classification toggle. This enables 2,500 random files to be scanned and classified each time.

2. In the Scan every list, select the cadence of how often the files are to be scanned. If you want the scans to occur less frequently, choose the Custom option and enter the amount of days, weeks, or months that you require.

10. Click Test Connection to ensure the connection works properly.

11. Click Save.

hint info

Note

You can add multiple connections under a single instance of the DSPM Fileshare applet by returning to the File Share Connection screen and clicking Add Connection. Each new connection can be of either the NFS or SMB connection type.

endhint

### Other actions

Once the DSPM Fileshare applet is activated, you can perform the following actions:

• Edit

• Deactivate: On the Broker VMs screen, in the ADD column, in the context menu, click Deactivate.

• Delete: On the File Share Connection screen, click the Delete icon next to the connection you want to remove.

Show markdown source

@@ -5,61 +5,63 @@ description: Configure this data source for Cortex XSIAM.
 # Activate DSPM Fileshare
 
 {% hint style="info" %}
 **License**
 
 This feature is included with a Cortex XSIAM Premium license. It is also included with a Cortex XSIAM NG SIEM and Cortex XSIAM Enterprise license that has the Cloud Posture Security or Cloud Runtime Security add-on.
 {% endhint %}
 
+The DSPM Fileshare applet is an application installed directly onto the Broker VM. The applet’s primary role is to establish and manage connections with your on-premise network file shares, including those using the SMB (Server Message Block) and NFS (Network File Sharing) protocols.
+
+Once configured, this applet continuously:
+
+* Accesses the designated file share paths.
+* Ingests the file and folder metadata.
+* Classifies files and identifies sensitive information.
+* Transmits the collected metadata and results securely through the Broker VM to Cortex XSIAM.
+
+By activating the DSPM Fileshare applet, you extend security coverage to your physical infrastructure, enabling classification for SMB and NFS file shares. This allows you to automatically discover stored content, identify sensitive data, and locate shadow backups, ensuring continuous visibility and consistent governance across hybrid and legacy environments.
+
 {% hint style="warning" %}
 Prerequisite
 
 * [Set up and configure Broker VM](../../../data-management/broker-vm/set-up-and-configure-broker-vm)
 * Know the complete path to the files and folders that you want Cortex XSIAM to monitor.
 * Necessary user permissions to access the network shares. For the SMB connection type, you need the user name and password.
 {% endhint %}
 
 ### How to activate the DSPM Fileshare applet
 
 1. Select **Settings** → **Configurations** → **Data Broker** → **Broker VMs**.
-2.  On the **Brokers** tab, find Broker VM, and in the **APPS** column, click **+ ADD**. In the list of applets, click **DSPM Fileshare**.
+2.  Do one of the following:
+
+    * On the **Brokers** tab, find the Broker VM, and in the **APPS** column, left-click **Add** → **DSPM Fileshare**.
+    * On the **Clusters** tab, find the Broker VM, and in the **APPS** column, left-click **Add** → **DSPM Fileshare**.
 
     <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The applet list displays only the applets for which you have permissions.</p></div>
-3.  Configure the DSPM Fileshare settings according to the following steps.
+3.  Configure the DSPM Fileshare settings.
 
     #### File Share Connection
 
-    | Field           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-    | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-    | Connection Type | <p>* <strong>NFS (Network File System):</strong> A distributed file system protocol that lets networked computers share files remotely, making them appear as if they're stored locally. Operating at the application layer, it uses Remote Procedure Calls (RPCs) for clients to access a server's files and directories.<br><br>* <strong>SMB (Server Message Block):</strong> A network file-sharing protocol that provides shared access to resources like files, printers, and serial ports across a network. It enables client applications to remotely interact with files and other assets stored on a server. It is the default file-sharing protocol for Microsoft Windows operating systems. This connection type requires a username and a password.</p> |
-    | Path            | Specify the host and path to the folder containing the files that you want Cortex Cloud Data Security to monitor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-    | Username        | For the SMB connection type only.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-    | Password        | For the SMB connection type only.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-    | Test Connection | Select to validate the connection permissions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+    | Field                  | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+    | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+    | File Share Connection  | Replace the text with a name for the new connection.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+    | Connection Type        | <p>* <strong>NFS (Network File System):</strong> A distributed file system protocol that lets networked computers share files remotely, making them appear as if they're stored locally. Operating at the application layer, it uses Remote Procedure Calls (RPCs) for clients to access a server's files and directories.<br><br>* <strong>SMB (Server Message Block):</strong> A network file-sharing protocol that provides shared access to resources like files, printers, and serial ports across a network. It enables client applications to remotely interact with files and other assets stored on a server. It is the default file-sharing protocol for Microsoft Windows operating systems. This connection type requires a username and a password.</p> |
+    | Path                   | Specify the host and path to the folder containing the files that you want Cortex XSIAM to monitor.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+    | Username               | For the SMB connection type only.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+    | Password               | For the SMB connection type only.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+    | Classification         | Decide whether to turn on the **Classification** toggle. This enables 2,500 random files to be scanned and classified each time.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+    | Scan every             | Select the cadence of how often the files are to be scanned. If you want the scans to occur less frequently, choose the **Custom** option and enter the amount of days, weeks, or months that you require.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+    | Test Connection        | Select to validate the connection permissions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 
     <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>By default, all configured connections are saved.</p></div>
-4.  On the **File Share Connection** screen, click **+ Add a Connection**.
-
-    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>For details regarding the connection fields, see the table above under File Share Connection.</p></div>
-5. In the **File Share Connection** field, replace the text with a name for the new connection.
-6. Select a connection type.
-7. Provide the path to the shared folder (the host and path).
-8. For SMB connections only, provide a username and password.
-9. Optionally, do the following:
-   1. Turn on the Classification toggle. This enables 2,500 random files to be scanned and classified each time.
-   2. In the Scan every list, select the cadence of how often the files are to be scanned. If you want the scans to occur less frequently, choose the Custom option and enter the amount of days, weeks, or months that you require.
-10. Click **Test Connection** to ensure the connection works properly.
-11. Click **Save**.
-
-{% hint style="info" %}
-**Note**
-
-You can add multiple connections under a single instance of the DSPM Fileshare applet by returning to the File Share Connection screen and clicking Add Connection. Each new connection can be of either the NFS or SMB connection type.
-{% endhint %}
+4. (Optional) Click **Add Connection** to define another database connection. You can add multiple connections under one DSPM Fileshare applet instance.
+5. Activate the DSPM Fileshare applet.\
+   After a successful activation, the **APPS** field displays DSPM Fileshare with a green dot indicating a successful connection.
 
 ### Other actions
 
 Once the DSPM Fileshare applet is activated, you can perform the following actions:
 
 * Edit
 * **Deactivate:** On the Broker VMs screen, in the ADD column, in the context menu, click Deactivate.
 * **Delete:** On the File Share Connection screen, click the Delete icon next to the connection you want to remove.

▸ Activate Registry Scanner modified +16 −16 Twelve broken-reference links now resolve to the Docker, GitLab, Harbor, JFrog and Sonatype Nexus registry pages; the licence note adds Cloud Posture Security.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-registry-scanner

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,63 +1,63 @@

---

description: Configure Registry Scanner for Cortex XSIAM.

description: Configure Registry Scanner applet for Cortex XSIAM.

---

# Activate Registry Scanner

The Broker VM provides a Registry Scanner applet that scans and secures your container image registries. It supports Docker V2 or JFrog self-hosted registries located on-premises or in private cloud networks.

hint info

License type: Requires a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM product that has the Cloud Runtime Security add-on.

License type: Requires a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM product that has the Cloud Posture security or the Cloud Runtime Security add-on.

endhint

hint info

Note

• You cannot activate the Registry Scanner directly on a new or existing Broker VM. You can only activate or deactivate existing Registry Scanner applets. To activate or deactivate existing applets, see Step 4 under Verify Registry Scanner connection section.

• You cannot activate the Registry Scanner directly on a new or existing Broker VM. You can only activate or deactivate existing Registry Scanner applets. To activate or deactivate existing applets, see Step 4 under Verify Registry Scanner connection section.

endhint

### Verify Registry Scanner connection

After the registry scanner is initialized, perform the following steps to verify that the Registry Scanner applet is connected to the Broker VM:

hint warning

### Prerequisite:

• To initialize registry scanning on your Broker VM, you must first add the necessary data connectors. For details, see:

• Connect Docker Hub registry

• Connect Docker V2 compliant container registry

• Connect GitLab container registry

• Connect Harbor registry

• Connect JFrog container registry

• Connect Sonatype Nexus registry

• When sizing your Broker VM, consider the following recommendations:

• Disk Size: Calculate the required disk space by multiplying the average container image size in your environment by 10. This factor accounts for simultaneous operations with a buffer.

      For example, If your average image size is 500 MB, allocate at least 5 GB of disk space (500 MB \* 10 = 5000 MB = 5 GB).

      For example, If your average image size is 500 MB, allocate at least 5 GB of disk space (500 MB \* 10 = 5000 MB = 5 GB).

• CPU: Allocate a minimum of 8 CPU cores.

• Memory: Allocate a minimum of 16 GB of RAM.

endhint

1. Go to Settings → Configurations → Data Broker → Broker VMs.

2. On either the Brokers or Clusters tab, find the Broker VM.

3. In the APPS column for the Broker VM, verify that the Registry Scanner app appears.

4. Select the Registry Scanner app to open a window displaying the following information:

    ![registry-scanner-applet-on-boker-vm-window-panel.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FndzyzKJVxTqh9cWUzfv6%2Fcontainer-registry.png?alt=media\&token=0d14ee28-3c2a-4f06-b8cd-24377b6ee1b8)

    ![registry-scanner-applet-on-boker-vm-window-panel.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FyUAstijtFSQYCFKpWOdf%2Fbroker-vm-reg-connector.png?alt=media\&token=4a77a8f7-32d3-48ee-8e74-7139d3c9289a)

• Connection: Shows the app's current connection status. You can also Deactivate the app.

To reactivate the **Registry Scanner** app, do one of the following:

• On the Brokers tab, locate the Broker VM, select +Add in the APPS column, and then choose Registry Scanner.

• On the Clusters tab, locate the Broker VM, select +Add in the APPS column, and then choose Registry Scanner.

        If the **Registry Scanner** app is not listed in the drop-down menu when you click **+Add**, it means that the registry scanning was not configured for that **Broker VM**. You must first add the data connectors.

        If the **Registry Scanner** app is not listed in the drop-down menu when you click **+Add**, it means that the registry scanning was not configured for that **Broker VM**. You must first add the data connectors.

• Resources: Shows the percentage of CPU, Memory, and Disk resources used by the app.

5. To manage the Registry Scanner applet, see:

• Manage a Docker Hub connector

• Manage a Docker V2 connector

• Manage a Gitlab Container Registry connector

• Manage a Harbor connector

• Manage a JFrog connector

• Manage a Sonatype connector

Show markdown source

@@ -1,63 +1,63 @@
 ---
-description: Configure Registry Scanner for Cortex XSIAM.
+description: Configure Registry Scanner applet for Cortex XSIAM.
 ---
 
 # Activate Registry Scanner
 
 The **Broker VM** provides a **Registry Scanner** applet that scans and secures your container image registries. It supports Docker V2 or JFrog self-hosted registries located on-premises or in private cloud networks.
 
 {% hint style="info" %}
-**License type:** Requires a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM product that has the Cloud Runtime Security add-on.
+**License type:** Requires a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM product that has the Cloud Posture security or the Cloud Runtime Security add-on.
 {% endhint %}
 
 {% hint style="info" %}
 **Note**
 
-* You cannot activate the **Registry Scanner** directly on a new or existing Broker VM. You can only activate or deactivate existing Registry Scanner applets. To activate or deactivate existing applets, see Step 4 under [Verify Registry Scanner connection](#verify-registry-scanner-connection) section.
+* You cannot activate the **Registry Scanner** directly on a new or existing Broker VM. You can only activate or deactivate existing Registry Scanner applets. To activate or deactivate existing applets, see **Step 4** under [Verify Registry Scanner connection](#verify-registry-scanner-connection) section.
 {% endhint %}
 
 ### **Verify Registry Scanner connection**
 
 After the registry scanner is initialized, perform the following steps to verify that the **Registry Scanner** applet is connected to the **Broker VM**:
 
 {% hint style="warning" %}
 ### Prerequisite:
 
 * To initialize registry scanning on your Broker VM, you must first add the necessary data connectors. For details, see:
-  * [Connect Docker Hub registry](broken-reference)
-  * [Connect Docker V2 compliant container registry](broken-reference)
-  * [Connect GitLab container registry](broken-reference)
-  * [Connect Harbor registry](broken-reference)
-  * [Connect JFrog container registry](broken-reference)
-  * [Connect Sonatype Nexus registry](broken-reference)
+  * [Connect Docker Hub registry](../../vendor-specific-data-sources-and-connectors/docker/connect-docker-hub-registry)
+  * [Connect Docker V2 compliant container registry](../../vendor-specific-data-sources-and-connectors/docker/connect-docker-v2-compliant-container-registry)
+  * [Connect GitLab container registry](../../vendor-specific-data-sources-and-connectors/gitlab/connect-gitlab-container-registry)
+  * [Connect Harbor registry](../../vendor-specific-data-sources-and-connectors/harbor/connect-harbor-registry)
+  * [Connect JFrog container registry](../../vendor-specific-data-sources-and-connectors/jfrog/connect-jfrog-container-registry)
+  * [Connect Sonatype Nexus registry](../../vendor-specific-data-sources-and-connectors/sonatype-nexus/connect-sonatype-nexus-registry)
 * When sizing your Broker VM, consider the following recommendations:
   *   **Disk Size:** Calculate the required disk space by multiplying the average container image size in your environment by 10. This factor accounts for simultaneous operations with a buffer.
 
       For example, If your average image size is 500 MB, allocate at least 5 GB of disk space (500 MB \* 10 = 5000 MB = 5 GB).
   * **CPU:** Allocate a minimum of 8 CPU cores.
   * **Memory:** Allocate a minimum of 16 GB of RAM.
 {% endhint %}
 
 1. Go to **Settings** → **Configurations** → **Data Broker** → **Broker VMs**.
 2. On either the **Brokers** or **Clusters tab**, find the Broker VM.
 3. In the **APPS** column for the **Broker VM**, verify that the **Registry Scanner** app appears.
 4.  Select the **Registry Scanner** app to open a window displaying the following information:
 
-    ![registry-scanner-applet-on-boker-vm-window-panel.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FndzyzKJVxTqh9cWUzfv6%2Fcontainer-registry.png?alt=media\&token=0d14ee28-3c2a-4f06-b8cd-24377b6ee1b8)
+    ![registry-scanner-applet-on-boker-vm-window-panel.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FyUAstijtFSQYCFKpWOdf%2Fbroker-vm-reg-connector.png?alt=media\&token=4a77a8f7-32d3-48ee-8e74-7139d3c9289a)
 
     *   **Connection**: Shows the app's current connection status. You can also **Deactivate** the app.
 
         To reactivate the **Registry Scanner** app, do one of the following:
 
         * On the **Brokers** tab, locate the Broker VM, select **+Add** in the **APPS** column, and then choose **Registry Scanner**.
         * On the **Clusters** tab, locate the Broker VM, select **+Add** in the **APPS** column, and then choose **Registry Scanner**.
 
         If the **Registry Scanner** app is not listed in the drop-down menu when you click **+Add**, it means that the registry scanning was not configured for that **Broker VM**. You must first add the data connectors.
     * **Resources**: Shows the percentage of **CPU**, **Memory**, and **Disk** resources used by the app.
 5. To manage the Registry Scanner applet, see:
-   * [Manage a Docker Hub connector](broken-reference)
-   * [Manage a Docker V2 connector](broken-reference)
-   * [Manage a Gitlab Container Registry connector](broken-reference)
-   * [Manage a Harbor connector](broken-reference)
-   * [Manage a JFrog connector](broken-reference)
-   * [Manage a Sonatype connector](broken-reference)
+   * [Manage a Docker Hub connector](../../vendor-specific-data-sources-and-connectors/docker/connect-docker-hub-registry/manage-a-docker-hub-connector)
+   * [Manage a Docker V2 connector](../../vendor-specific-data-sources-and-connectors/docker/connect-docker-v2-compliant-container-registry/manage-a-docker-v2-connector)
+   * [Manage a Gitlab Container Registry connector](../../vendor-specific-data-sources-and-connectors/gitlab/connect-gitlab-container-registry/manage-a-gitlab-container-registry-connector)
+   * [Manage a Harbor connector](../../vendor-specific-data-sources-and-connectors/harbor/connect-harbor-registry/manage-a-harbor-connector)
+   * [Manage a JFrog connector](../../vendor-specific-data-sources-and-connectors/jfrog/connect-jfrog-container-registry/manage-a-jfrog-connector)
+   * [Manage a Sonatype connector](../../vendor-specific-data-sources-and-connectors/sonatype-nexus/connect-sonatype-nexus-registry/manage-a-sonatype-connector)

▸ 1Password modified +4 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/1password

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,10 @@

---

description: Configure the 1Password integration for Cortex XSIAM.

description: Configure the 1Password connector for Cortex XSIAM.

---

# 1Password

1password

| ------------------------------------------ |

Show markdown source

@@ -1,7 +1,10 @@
 ---
-description: Configure the 1Password integration for Cortex XSIAM.
+description: Configure the 1Password connector for Cortex XSIAM.
 ---
 
 # 1Password
 
+| [1password](1password/1password "mention") |
+| ------------------------------------------ |
+
 ***

▸ Abnormal Security modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abnormal-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the Abnormal Security integration for Cortex XSIAM.

description: Configure the Abnormal Security connector for Cortex XSIAM.

---

# Abnormal Security

Here are the articles in this section:

• abnormal-security

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the Abnormal Security integration for Cortex XSIAM.
+description: Configure the Abnormal Security connector for Cortex XSIAM.
 ---
 
 # Abnormal Security
 
+Here are the articles in this section:
+
+* [abnormal-security](abnormal-security/abnormal-security "mention")
+
 ***

▸ Absolute modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/absolute

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the Absolute integration for Cortex XSIAM.

description: Configure the Absolute connector for Cortex XSIAM.

---

# Absolute

Here are the articles in this section:

• absolute

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the Absolute integration for Cortex XSIAM.
+description: Configure the Absolute connector for Cortex XSIAM.
 ---
 
 # Absolute
 
+Here are the articles in this section:
+
+* [absolute](absolute/absolute "mention")
+
 ***

▸ abuse.ch modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abuse.ch

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the abuse.ch integration for Cortex XSIAM.

description: Configure the abuse.ch connector for Cortex XSIAM.

---

# abuse.ch

Here are the articles in this section:

• abuse.ch

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the abuse.ch integration for Cortex XSIAM.
+description: Configure the abuse.ch connector for Cortex XSIAM.
 ---
 
 # abuse.ch
 
+Here are the articles in this section:
+
+* [abuse.ch](abuse.ch/abuse.ch "mention")
+
 ***

▸ AbuseIPDB modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abuseipdb

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the AbuseIPDB integration for Cortex XSIAM.

description: Configure the AbuseIPDB connector for Cortex XSIAM.

---

# AbuseIPDB

Here are the articles in this section:

• abuseipdb

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the AbuseIPDB integration for Cortex XSIAM.
+description: Configure the AbuseIPDB connector for Cortex XSIAM.
 ---
 
 # AbuseIPDB
 
+Here are the articles in this section:
+
+* [abuseipdb](abuseipdb/abuseipdb "mention")
+
 ***

▸ Accenture modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/accenture

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the Accenture integration for Cortex XSIAM.

description: Configure the Accenture connector for Cortex XSIAM.

---

# Accenture

Here are the articles in this section:

• accenture

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the Accenture integration for Cortex XSIAM.
+description: Configure the Accenture connector for Cortex XSIAM.
 ---
 
 # Accenture
 
+Here are the articles in this section:
+
+* [accenture](accenture/accenture "mention")
+
 ***

▸ AdminByRequest modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/adminbyrequest

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the AdminByRequest integration for Cortex XSIAM.

description: Configure the AdminByRequest connector for Cortex XSIAM.

---

# AdminByRequest

Here are the articles in this section:

• adminbyrequest

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the AdminByRequest integration for Cortex XSIAM.
+description: Configure the AdminByRequest connector for Cortex XSIAM.
 ---
 
 # AdminByRequest
 
+Here are the articles in this section:
+
+* [adminbyrequest](adminbyrequest/adminbyrequest "mention")
+
 ***

▸ Aha modified +6 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aha

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,12 @@

---

description: Configure the Aha integration for Cortex XSIAM.

description: Configure the Aha connectors for Cortex XSIAM.

---

# Aha

Here are the articles in this section:

• aha

• aha-1

Show markdown source

@@ -1,7 +1,12 @@
 ---
-description: Configure the Aha integration for Cortex XSIAM.
+description: Configure the Aha connectors for Cortex XSIAM.
 ---
 
 # Aha
 
+Here are the articles in this section:
+
+* [aha](aha/aha "mention")
+* [aha-1](aha/aha-1 "mention")
+
 ***

▸ AIOps modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aiops

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the AIOps integration for Cortex XSIAM.

description: Configure the AIOps connector for Cortex XSIAM.

---

# AIOps

Here are the articles in this section:

• aiops

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the AIOps integration for Cortex XSIAM.
+description: Configure the AIOps connector for Cortex XSIAM.
 ---
 
 # AIOps
 
+Here are the articles in this section:
+
+* [aiops](aiops/aiops "mention")
+
 ***

▸ Akamai modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/akamai

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the Akamai integration for Cortex XSIAM.

description: Configure the Akamai connector for Cortex XSIAM.

---

# Akamai

Here are the articles in this section:

• akamai

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the Akamai integration for Cortex XSIAM.
+description: Configure the Akamai connector for Cortex XSIAM.
 ---
 
 # Akamai
 
+Here are the articles in this section:
+
+* [akamai](akamai/akamai "mention")
+
 ***

▸ AlgoSec modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/algosec

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the AlgoSec integration for Cortex XSIAM.

description: Configure the AlgoSec connector for Cortex XSIAM.

---

# AlgoSec

Here are the articles in this section:

• algosec

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the AlgoSec integration for Cortex XSIAM.
+description: Configure the AlgoSec connector for Cortex XSIAM.
 ---
 
 # AlgoSec
 
+Here are the articles in this section:
+
+* [algosec](algosec/algosec "mention")
+
 ***

▸ Alibaba Cloud modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/alibaba-cloud

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the Alibaba Cloud integration for Cortex XSIAM.

description: Configure the Alibaba Cloud connector for Cortex XSIAM.

---

# Alibaba Cloud

Here are the articles in this section:

• alibaba-cloud

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the Alibaba Cloud integration for Cortex XSIAM.
+description: Configure the Alibaba Cloud connector for Cortex XSIAM.
 ---
 
 # Alibaba Cloud
 
+Here are the articles in this section:
+
+* [alibaba-cloud](alibaba-cloud/alibaba-cloud "mention")
+
 ***

▸ AlienVault modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/alienvault

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the AlienVault integration for Cortex XSIAM.

description: Configure the AlienVault connector for Cortex XSIAM.

---

# AlienVault

Here are the articles in this section:

• alienvault

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the AlienVault integration for Cortex XSIAM.
+description: Configure the AlienVault connector for Cortex XSIAM.
 ---
 
 # AlienVault
 
+Here are the articles in this section:
+
+* [alienvault](alienvault/alienvault "mention")
+
 ***

▸ Amazon modified +11 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,14 @@

---

description: Configure the Amazon data sources and connectors for Cortex XSIAM.

---

# Amazon

Here are the articles in this section:

• amazon-cloud-watch

• amazon-s3

• amazon-web-services

• aws-automation-and-collection

Show markdown source

@@ -1,3 +1,14 @@
+---
+description: Configure the Amazon data sources and connectors for Cortex XSIAM.
+---
+
 # Amazon
 
+Here are the articles in this section:
+
+* [amazon-cloud-watch](amazon/amazon-cloud-watch "mention")
+* [amazon-s3](amazon/amazon-s3 "mention")
+* [amazon-web-services](amazon/amazon-web-services "mention")
+* [aws-automation-and-collection](amazon/aws-automation-and-collection "mention")
+
 ***

▸ Anomali modified +5 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/anomali

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,11 @@

---

description: Configure the Anomali integration for Cortex XSIAM.

description: Configure the Anomali connector for Cortex XSIAM.

---

# Anomali

Here are the articles in this section:

• anomali

Show markdown source

@@ -1,7 +1,11 @@
 ---
-description: Configure the Anomali integration for Cortex XSIAM.
+description: Configure the Anomali connector for Cortex XSIAM.
 ---
 
 # Anomali
 
+Here are the articles in this section:
+
+* [anomali](anomali/anomali "mention")
+
 ***

▸ Anthropic modified +6 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/anthropic

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,7 +1,12 @@

---

description: Configure the Anthropic integration for Cortex XSIAM.

description: Configure the Anthropic connectors for Cortex XSIAM.

---

# Anthropic

Here are the articles in this section:

• claude-automation-and-collection

• claude

Show markdown source

@@ -1,7 +1,12 @@
 ---
-description: Configure the Anthropic integration for Cortex XSIAM.
+description: Configure the Anthropic connectors for Cortex XSIAM.
 ---
 
 # Anthropic
 
+Here are the articles in this section:
+
+* [claude-automation-and-collection](anthropic/claude-automation-and-collection "mention")
+* [claude](anthropic/claude "mention")
+
 ***

▸ Apache modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apache

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Apache connector for Cortex XSIAM.

---

# Apache

Here are the articles in this section:

• apache

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Apache connector for Cortex XSIAM.
+---
+
 # Apache
 
+Here are the articles in this section:
+
+* [apache](apache/apache "mention")
+
 ***

▸ APIVoid modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apivoid

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the APIVoid connector for Cortex XSIAM.

---

# APIVoid

Here are the articles in this section:

• apivoid

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the APIVoid connector for Cortex XSIAM.
+---
+
 # APIVoid
 
+Here are the articles in this section:
+
+* [apivoid](apivoid/apivoid "mention")
+
 ***

▸ Apollo.io modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apollo.io

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Apollo.io connector for Cortex XSIAM.

---

# Apollo.io

Here are the articles in this section:

• apollo.io

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Apollo.io connector for Cortex XSIAM.
+---
+
 # Apollo.io
 
+Here are the articles in this section:
+
+* [apollo.io](apollo.io/apollo.io "mention")
+
 ***

▸ AppSentinels modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/appsentinels

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the AppSentinels connector for Cortex XSIAM.

---

# AppSentinels

Here are the articles in this section:

• appsentinels

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the AppSentinels connector for Cortex XSIAM.
+---
+
 # AppSentinels
 
+Here are the articles in this section:
+
+* [appsentinels](appsentinels/appsentinels "mention")
+
 ***

▸ ArcSight modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arcsight

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the ArcSight connector for Cortex XSIAM.

---

# ArcSight

Here are the articles in this section:

• arcsight

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the ArcSight connector for Cortex XSIAM.
+---
+
 # ArcSight
 
+Here are the articles in this section:
+
+* [arcsight](arcsight/arcsight "mention")
+
 ***

▸ Arista Networks modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arista-networks

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Arista Networks connector for Cortex XSIAM.

---

# Arista Networks

Here are the articles in this section:

• arista-networks

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Arista Networks connector for Cortex XSIAM.
+---
+
 # Arista Networks
 
+Here are the articles in this section:
+
+* [arista-networks](arista-networks/arista-networks "mention")
+
 ***

▸ Arkime modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arkime

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Arkime connector for Cortex XSIAM.

---

# Arkime

Here are the articles in this section:

• arkime

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Arkime connector for Cortex XSIAM.
+---
+
 # Arkime
 
+Here are the articles in this section:
+
+* [arkime](arkime/arkime "mention")
+
 ***

▸ Armis modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/armis

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Armis connector for Cortex XSIAM.

---

# Armis

Here are the articles in this section:

• armis

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Armis connector for Cortex XSIAM.
+---
+
 # Armis
 
+Here are the articles in this section:
+
+* [armis](armis/armis "mention")
+
 ***

▸ Articulate Global modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/articulate-global

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Articulate Global connector for Cortex XSIAM.

---

# Articulate Global

Here are the articles in this section:

• articulate-global

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Articulate Global connector for Cortex XSIAM.
+---
+
 # Articulate Global
 
+Here are the articles in this section:
+
+* [articulate-global](articulate-global/articulate-global "mention")
+
 ***

▸ Asana modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/asana

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Asana connector for Cortex XSIAM.

---

# Asana

Here are the articles in this section:

• asana

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Asana connector for Cortex XSIAM.
+---
+
 # Asana
 
+Here are the articles in this section:
+
+* [asana](asana/asana "mention")
+
 ***

▸ Atlassian modified +9 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/atlassian

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,12 @@

---

description: Configure the Atlassian connectors for Cortex XSIAM.

---

# Atlassian

Here are the articles in this section:

• atlassian

• atlassian-automation-and-collection

Show markdown source

@@ -1,3 +1,12 @@
+---
+description: Configure the Atlassian connectors for Cortex XSIAM.
+---
+
 # Atlassian
 
+Here are the articles in this section:
+
+* [atlassian](atlassian/atlassian "mention")
+* [atlassian-automation-and-collection](atlassian/atlassian-automation-and-collection "mention")
+
 ***

▸ AttackIQ modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/attackiq

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the AttackIQ connector for Cortex XSIAM.

---

# AttackIQ

Here are the articles in this section:

• attackiq

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the AttackIQ connector for Cortex XSIAM.
+---
+
 # AttackIQ
 
+Here are the articles in this section:
+
+* [attackiq](attackiq/attackiq "mention")
+
 ***

▸ Aurora Endpoint Security modified +8 −0

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aurora-endpoint-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Aurora Endpoint Security connector for Cortex XSIAM.

---

# Aurora Endpoint Security

Here are the articles in this section:

• aurora-endpoint-security

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Aurora Endpoint Security connector for Cortex XSIAM.
+---
+
 # Aurora Endpoint Security
 
+Here are the articles in this section:
+
+* [aurora-endpoint-security](aurora-endpoint-security/aurora-endpoint-security "mention")
+
 ***

▸ Automox modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/automox

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Automox connector for Cortex XSIAM.

---

# Automox

Here are the articles in this section:

• automox

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Automox connector for Cortex XSIAM.
+---
+
 # Automox
 
+Here are the articles in this section:
+
+* [automox](automox/automox "mention")
+
 ***

▸ BeyondTrust modified +9 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/beyondtrust

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,12 @@

---

description: Configure the BeyondTrust data source and connector for Cortex XSIAM.

---

# BeyondTrust

Here are the articles in this section:

• beyondtrust-privilege-management-cloud

• beyondtrust

Show markdown source

@@ -1,3 +1,12 @@
+---
+description: Configure the BeyondTrust data source and connector for Cortex XSIAM.
+---
+
 # BeyondTrust
 
+Here are the articles in this section:
+
+* [beyondtrust-privilege-management-cloud](beyondtrust/beyondtrust-privilege-management-cloud "mention")
+* [beyondtrust](beyondtrust/beyondtrust "mention")
+
 ***

▸ BitSight modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bitsight

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the BitSight connector for Cortex XSIAM.

---

# BitSight

Here are the articles in this section:

• bitsight

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the BitSight connector for Cortex XSIAM.
+---
+
 # BitSight
 
+Here are the articles in this section:
+
+* [bitsight](bitsight/bitsight "mention")
+
 ***

▸ bitwarden modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bitwarden

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the bitwarden connector for Cortex XSIAM.

---

# bitwarden

Here are the articles in this section:

• bitwarden

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the bitwarden connector for Cortex XSIAM.
+---
+
 # bitwarden
 
+Here are the articles in this section:
+
+* [bitwarden](bitwarden/bitwarden "mention")
+
 ***

▸ Blocklist.de modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/blocklist.de

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Blocklist.de connector for Cortex XSIAM.

---

# Blocklist.de

Here are the articles in this section:

• blocklist.de

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Blocklist.de connector for Cortex XSIAM.
+---
+
 # Blocklist.de
 
+Here are the articles in this section:
+
+* [blocklist.de](blocklist.de/blocklist.de "mention")
+
 ***

▸ BloodHound Enterprise modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bloodhound-enterprise

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the BloodHound Enterprise connector for Cortex XSIAM.

---

# BloodHound Enterprise

Here are the articles in this section:

• bloodhound-enterprise

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the BloodHound Enterprise connector for Cortex XSIAM.
+---
+
 # BloodHound Enterprise
 
+Here are the articles in this section:
+
+* [bloodhound-enterprise](bloodhound-enterprise/bloodhound-enterprise "mention")
+
 ***

▸ BlueCat Address Manager modified +8 −0

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bluecat-address-manager

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the BlueCat Address Manager connector for Cortex XSIAM.

---

# BlueCat Address Manager

Here are the articles in this section:

• bluecat-address-manager

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the BlueCat Address Manager connector for Cortex XSIAM.
+---
+
 # BlueCat Address Manager
 
+Here are the articles in this section:
+
+* [bluecat-address-manager](bluecat-address-manager/bluecat-address-manager "mention")
+
 ***

▸ BMC modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bmc

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the BMC connector for Cortex XSIAM.

---

# BMC

Here are the articles in this section:

• bmc

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the BMC connector for Cortex XSIAM.
+---
+
 # BMC
 
+Here are the articles in this section:
+
+* [bmc](bmc/bmc "mention")
+
 ***

▸ Broadcom modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/broadcom

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Broadcom connector for Cortex XSIAM.

---

# Broadcom

Here are the articles in this section:

• broadcom

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Broadcom connector for Cortex XSIAM.
+---
+
 # Broadcom
 
+Here are the articles in this section:
+
+* [broadcom](broadcom/broadcom "mention")
+
 ***

▸ BruteForceBlocker modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bruteforceblocker

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the BruteForceBlocker connector for Cortex XSIAM.

---

# BruteForceBlocker

Here are the articles in this section:

• bruteforceblocker

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the BruteForceBlocker connector for Cortex XSIAM.
+---
+
 # BruteForceBlocker
 
+Here are the articles in this section:
+
+* [bruteforceblocker](bruteforceblocker/bruteforceblocker "mention")
+
 ***

▸ Businessmap modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/businessmap

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Businessmap connector for Cortex XSIAM.

---

# Businessmap

Here are the articles in this section:

• businessmap

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Businessmap connector for Cortex XSIAM.
+---
+
 # Businessmap
 
+Here are the articles in this section:
+
+* [businessmap](businessmap/businessmap "mention")
+
 ***

▸ C2SEC modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/c2sec

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the C2SEC connector for Cortex XSIAM.

---

# C2SEC

Here are the articles in this section:

• c2sec

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the C2SEC connector for Cortex XSIAM.
+---
+
 # C2SEC
 
+Here are the articles in this section:
+
+* [c2sec](c2sec/c2sec "mention")
+
 ***

▸ CAPESandbox modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/capesandbox

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the CAPESandbox connector for Cortex XSIAM.

---

# CAPESandbox

Here are the articles in this section:

• capesandbox

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the CAPESandbox connector for Cortex XSIAM.
+---
+
 # CAPESandbox
 
+Here are the articles in this section:
+
+* [capesandbox](capesandbox/capesandbox "mention")
+
 ***

▸ Carbon Black modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/carbon-black

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Carbon Black connector for Cortex XSIAM.

---

# Carbon Black

Here are the articles in this section:

• carbon-black

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Carbon Black connector for Cortex XSIAM.
+---
+
 # Carbon Black
 
+Here are the articles in this section:
+
+* [carbon-black](carbon-black/carbon-black "mention")
+
 ***

▸ Celonis modified +9 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/celonis

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,12 @@

---

description: Configure the Celonis connectors for Cortex XSIAM.

---

# Celonis

Here are the articles in this section:

• celonis-collection

• celonis

Show markdown source

@@ -1,3 +1,12 @@
+---
+description: Configure the Celonis connectors for Cortex XSIAM.
+---
+
 # Celonis
 
+Here are the articles in this section:
+
+* [celonis-collection](celonis/celonis-collection "mention")
+* [celonis](celonis/celonis "mention")
+
 ***

▸ Centreon modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/centreon

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Centreon connector for Cortex XSIAM.

---

# Centreon

Here are the articles in this section:

• centreon

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Centreon connector for Cortex XSIAM.
+---
+
 # Centreon
 
+Here are the articles in this section:
+
+* [centreon](centreon/centreon "mention")
+
 ***

▸ ChatGPT Enterprise modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/chatgpt-enterprise

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the ChatGPT Enterprise connector for Cortex XSIAM.

---

# ChatGPT Enterprise

Here are the articles in this section:

• chatgpt-enterprise

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the ChatGPT Enterprise connector for Cortex XSIAM.
+---
+
 # ChatGPT Enterprise
 
+Here are the articles in this section:
+
+* [chatgpt-enterprise](chatgpt-enterprise/chatgpt-enterprise "mention")
+
 ***

▸ Check Point modified +9 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/check-point

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,12 @@

---

description: Configure the Check Point data source and connector for Cortex XSIAM.

---

# Check Point

Here are the articles in this section:

• check-point-fw1-vpn1

• checkpoint-firewall

Show markdown source

@@ -1,3 +1,12 @@
+---
+description: Configure the Check Point data source and connector for Cortex XSIAM.
+---
+
 # Check Point
 
+Here are the articles in this section:
+
+* [check-point-fw1-vpn1](check-point/check-point-fw1-vpn1 "mention")
+* [checkpoint-firewall](check-point/checkpoint-firewall "mention")
+
 ***

▸ CheckPhish modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/checkphish

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the CheckPhish connector for Cortex XSIAM.

---

# CheckPhish

Here are the articles in this section:

• checkphish

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the CheckPhish connector for Cortex XSIAM.
+---
+
 # CheckPhish
 
+Here are the articles in this section:
+
+* [checkphish](checkphish/checkphish "mention")
+
 ***

▸ CipherTrust modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ciphertrust

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the CipherTrust connector for Cortex XSIAM.

---

# CipherTrust

Here are the articles in this section:

• ciphertrust

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the CipherTrust connector for Cortex XSIAM.
+---
+
 # CipherTrust
 
+Here are the articles in this section:
+
+* [ciphertrust](ciphertrust/ciphertrust "mention")
+
 ***

▸ CIRCL modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/circl

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the CIRCL connector for Cortex XSIAM.

---

# CIRCL

Here are the articles in this section:

• circl

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the CIRCL connector for Cortex XSIAM.
+---
+
 # CIRCL
 
+Here are the articles in this section:
+
+* [circl](circl/circl "mention")
+
 ***

▸ CircleCI modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/circleci

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the CircleCI connector for Cortex XSIAM.

---

# CircleCI

Here are the articles in this section:

• circleci

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the CircleCI connector for Cortex XSIAM.
+---
+
 # CircleCI
 
+Here are the articles in this section:
+
+* [circleci](circleci/circleci "mention")
+
 ***

▸ Cisco modified +17 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,20 @@

---

description: Configure the Cisco data sources and connectors for Cortex XSIAM.

---

# Cisco

Here are the articles in this section:

• cisco-asa-firewalls-and-anyconnect

• cisco-asa

• cisco-duo

• cisco-duo-automation-and-collection

• cisco-firepower

• cisco-ise

• cisco-meraki

• cisco-meraki-automation-and-remediation

• cisco-security

• cisco-umbrella

Show markdown source

@@ -1,3 +1,20 @@
+---
+description: Configure the Cisco data sources and connectors for Cortex XSIAM.
+---
+
 # Cisco
 
+Here are the articles in this section:
+
+* [cisco-asa-firewalls-and-anyconnect](cisco/cisco-asa-firewalls-and-anyconnect "mention")
+* [cisco-asa](cisco/cisco-asa "mention")
+* [cisco-duo](cisco/cisco-duo "mention")
+* [cisco-duo-automation-and-collection](cisco/cisco-duo-automation-and-collection "mention")
+* [cisco-firepower](cisco/cisco-firepower "mention")
+* [cisco-ise](cisco/cisco-ise "mention")
+* [cisco-meraki](cisco/cisco-meraki "mention")
+* [cisco-meraki-automation-and-remediation](cisco/cisco-meraki-automation-and-remediation "mention")
+* [cisco-security](cisco/cisco-security "mention")
+* [cisco-umbrella](cisco/cisco-umbrella "mention")
+
 ***

▸ Citrix modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/citrix

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Citrix connector for Cortex XSIAM.

---

# Citrix

Here are the articles in this section:

• citrix

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Citrix connector for Cortex XSIAM.
+---
+
 # Citrix
 
+Here are the articles in this section:
+
+* [citrix](citrix/citrix "mention")
+
 ***

▸ ClickUp modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/clickup

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the ClickUp connector for Cortex XSIAM.

---

# ClickUp

Here are the articles in this section:

• clickup

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the ClickUp connector for Cortex XSIAM.
+---
+
 # ClickUp
 
+Here are the articles in this section:
+
+* [clickup](clickup/clickup "mention")
+
 ***

▸ Cloaken modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloaken

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Cloaken connector for Cortex XSIAM.

---

# Cloaken

Here are the articles in this section:

• cloaken

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Cloaken connector for Cortex XSIAM.
+---
+
 # Cloaken
 
+Here are the articles in this section:
+
+* [cloaken](cloaken/cloaken "mention")
+
 ***

▸ CloudConvert modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloudconvert

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the CloudConvert connector for Cortex XSIAM.

---

# CloudConvert

Here are the articles in this section:

• cloudconvert

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the CloudConvert connector for Cortex XSIAM.
+---
+
 # CloudConvert
 
+Here are the articles in this section:
+
+* [cloudconvert](cloudconvert/cloudconvert "mention")
+
 ***

▸ Cloudflare modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloudflare

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Cloudflare connector for Cortex XSIAM.

---

# Cloudflare

Here are the articles in this section:

• cloudflare

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Cloudflare connector for Cortex XSIAM.
+---
+
 # Cloudflare
 
+Here are the articles in this section:
+
+* [cloudflare](cloudflare/cloudflare "mention")
+
 ***

▸ Code42 modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/code42

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Code42 connector for Cortex XSIAM.

---

# Code42

Here are the articles in this section:

• code42

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Code42 connector for Cortex XSIAM.
+---
+
 # Code42
 
+Here are the articles in this section:
+
+* [code42](code42/code42 "mention")
+
 ***

▸ Cohesity modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cohesity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Cohesity connector for Cortex XSIAM.

---

# Cohesity

Here are the articles in this section:

• cohesity

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Cohesity connector for Cortex XSIAM.
+---
+
 # Cohesity
 
+Here are the articles in this section:
+
+* [cohesity](cohesity/cohesity "mention")
+
 ***

▸ Contentful modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/contentful

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Contentful connector for Cortex XSIAM.

---

# Contentful

Here are the articles in this section:

• contentful

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Contentful connector for Cortex XSIAM.
+---
+
 # Contentful
 
+Here are the articles in this section:
+
+* [contentful](contentful/contentful "mention")
+
 ***

▸ Corelight modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/corelight

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Corelight data source for Cortex XSIAM.

---

# Corelight

Here are the articles in this section:

• corelight-zeek

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Corelight data source for Cortex XSIAM.
+---
+
 # Corelight
 
+Here are the articles in this section:
+
+* [corelight-zeek](corelight/corelight-zeek "mention")
+
 ***

▸ Couchbase modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/couchbase

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Couchbase connector for Cortex XSIAM.

---

# Couchbase

Here are the articles in this section:

• couchbase

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Couchbase connector for Cortex XSIAM.
+---
+
 # Couchbase
 
+Here are the articles in this section:
+
+* [couchbase](couchbase/couchbase "mention")
+
 ***

▸ CounterTack modified +7 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/countertack

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,9 @@

---

description: Configure the CounterTrack connector for Cortex XSIAM.

---

# CounterTack

Connector documentation for CounterTack.

Here are the articles in this section:

• countertack

Show markdown source

@@ -1,3 +1,9 @@
+---
+description: Configure the CounterTrack connector for Cortex XSIAM.
+---
+
 # CounterTack
 
-Connector documentation for CounterTack.
+Here are the articles in this section:
+
+* [countertack](countertack/countertack "mention")

▸ Coveo modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/coveo

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Coveo connector for Cortex XSIAM.

---

# Coveo

Here are the articles in this section:

• coveo

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Coveo connector for Cortex XSIAM.
+---
+
 # Coveo
 
+Here are the articles in this section:
+
+* [coveo](coveo/coveo "mention")
+
 ***

▸ Cribl modified +4 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cribl

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,8 +1,12 @@

---

description: Configure the Cribl data source and connector for Cortex XSIAM.

---

# Cribl

You can configure collecting Cribl data using a standard data source or connector (onboarded after July 26, 2026):

Collection Method│Description

| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Standard data source overview│Forward data that Cribl collects from multiple data sources and streams to Cortex XSIAM using a Cribl data source.

Link to standard data source instructions│

Ingest data from Cribl

Configuring this data source includes this topic:

Disable or delete Cribl integration
Data source UUIDs
Collect Windows Event Logs for Cortex XSIAM via Cribl

Link to standard data source instructions│

Ingest data from Cribl

Configuring this data source includes this topic:

Disable or delete Cribl integration
Data source UUIDs
Collect Windows Event Logs for Cortex XSIAM via Cribl

Show markdown source

@@ -1,8 +1,12 @@
+---
+description: Configure the Cribl data source and connector for Cortex XSIAM.
+---
+
 # Cribl
 
 You can configure collecting Cribl data using a standard data source or connector (onboarded after July 26, 2026):
 
 | Collection Method                                 | Description                                                                                                                                                                                                                                                                   |
 | ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Standard data source overview                     | Forward data that Cribl collects from multiple data sources and streams to Cortex XSIAM using a Cribl data source.                                                                                                                                                            |
 | Link to standard data source instructions         | <p><a href="cribl/ingest-data-from-cribl">Ingest data from Cribl</a></p><p>Configuring this data source includes this topic:</p><ul><li>Disable or delete Cribl integration</li><li>Data source UUIDs</li><li>Collect Windows Event Logs for Cortex XSIAM via Cribl</li></ul> |

▸ CrowdStrike modified +10 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrike

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,13 @@

---

description: Configure the CrowdStrike data sources and connector for Cortex XSIAM.

---

# CrowdStrike

Here are the articles in this section:

• crowdstrike-apis

• crowdstrike-falcon-data-replicator

• crowdstrike

Show markdown source

@@ -1,3 +1,13 @@
+---
+description: Configure the CrowdStrike data sources and connector for Cortex XSIAM.
+---
+
 # CrowdStrike
 
+Here are the articles in this section:
+
+* [crowdstrike-apis](crowdstrike/crowdstrike-apis "mention")
+* [crowdstrike-falcon-data-replicator](crowdstrike/crowdstrike-falcon-data-replicator "mention")
+* [crowdstrike](crowdstrike/crowdstrike "mention")
+
 ***

▸ CryptoCurrency modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cryptocurrency

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the CryptoCurrency connector for Cortex XSIAM.

---

# CryptoCurrency

Here are the articles in this section:

• cryptocurrency

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the CryptoCurrency connector for Cortex XSIAM.
+---
+
 # CryptoCurrency
 
+Here are the articles in this section:
+
+* [cryptocurrency](cryptocurrency/cryptocurrency "mention")
+
 ***

▸ Cuckoo Sandbox modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cuckoo-sandbox

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Cuckoo Sandbox connector for Cortex XSIAM.

---

# Cuckoo Sandbox

Here are the articles in this section:

• cuckoo-sandbox

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Cuckoo Sandbox connector for Cortex XSIAM.
+---
+
 # Cuckoo Sandbox
 
+Here are the articles in this section:
+
+* [cuckoo-sandbox](cuckoo-sandbox/cuckoo-sandbox "mention")
+
 ***

▸ Cursor modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cursor

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the Cursor connector for Cortex XSIAM.

---

# Cursor

Here are the articles in this section:

• cursor

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the Cursor connector for Cortex XSIAM.
+---
+
 # Cursor
 
+Here are the articles in this section:
+
+* [cursor](cursor/cursor "mention")
+
 ***

▸ CybelAngel modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cybelangel

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,3 +1,11 @@

---

description: Configure the CybelAngel connector for Cortex XSIAM.

---

# CybelAngel

Here are the articles in this section:

• cybelangel

Show markdown source

@@ -1,3 +1,11 @@
+---
+description: Configure the CybelAngel connector for Cortex XSIAM.
+---
+
 # CybelAngel
 
+Here are the articles in this section:
+
+* [cybelangel](cybelangel/cybelangel "mention")
+
 ***

▸ Cyber Triage modified +7 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyber-triage

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,9 @@

---

description: Configure the Cyber Triage connector for Cortex XSIAM.

---

# Cyber Triage

Here are the articles in this section:

• cyber-triage

Show markdown source

@@ -1,2 +1,9 @@
+---
+description: Configure the Cyber Triage connector for Cortex XSIAM.
+---
+
 # Cyber Triage
 
+Here are the articles in this section:
+
+* [cyber-triage](cyber-triage/cyber-triage "mention")

▸ CyberArk modified +7 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyberark

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,9 @@

---

description: Configure the CyberArk connector for Cortex XSIAM.

---

# CyberArk

Here are the articles in this section:

• cyberark

Show markdown source

@@ -1,2 +1,9 @@
+---
+description: Configure the CyberArk connector for Cortex XSIAM.
+---
+
 # CyberArk
 
+Here are the articles in this section:
+
+* [cyberark](cyberark/cyberark "mention")

▸ CYFIRMA modified +3 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyfirma

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,5 @@

# CYFIRMA

Here are the articles in this section:

• cyfirma Configure the CYFIRMA connector for Cortex XSIAM.

Show markdown source

@@ -1,2 +1,5 @@
 # CYFIRMA
 
+Here are the articles in this section:
+
+* [cyfirma](cyfirma/cyfirma "mention") Configure the CYFIRMA connector for Cortex XSIAM.

▸ Darktrace modified +7 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/darktrace

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,9 @@

---

description: Configure the Darktrace connector for Cortex XSIAM.

---

# Darktrace

Here are the articles in this section:

• darktrace

Show markdown source

@@ -1,2 +1,9 @@
+---
+description: Configure the Darktrace connector for Cortex XSIAM.
+---
+
 # Darktrace
 
+Here are the articles in this section:
+
+* [darktrace](darktrace/darktrace "mention")

▸ Databricks modified +4 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/databricks

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,8 +1,12 @@

---

description: Configure the Databricks data source and connector for Cortex XSIAM.

---

# Databricks

You can configure collecting Databricks logs using a Cloud Posture and Runtime Security data source or connector:

Collection Method│Description

| ------------------------------------------------------------------- | ----------------------------------------------------------------- |

| ------------------------------------------------------------------- | ----------------------------------------------------------------- |

Cloud Posture and Runtime Security data source overview│Add the Databricks platform as a third-party data source.

Link to Cloud Posture and Runtime Security data source instructions│How to onboard Databricks

Show markdown source

@@ -1,8 +1,12 @@
+---
+description: Configure the Databricks data source and connector for Cortex XSIAM.
+---
+
 # Databricks
 
 You can configure collecting Databricks logs using a Cloud Posture and Runtime Security data source or connector:
 
 | Collection Method                                                   | Description                                                       |
 | ------------------------------------------------------------------- | ----------------------------------------------------------------- |
 | Cloud Posture and Runtime Security data source overview             | Add the Databricks platform as a third-party data source.         |
 | Link to Cloud Posture and Runtime Security data source instructions | [How to onboard Databricks](databricks/how-to-onboard-databricks) |

▸ DataDog modified +3 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/datadog

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,5 @@

# DataDog

Here are the articles in this section:

• datadog Configure the DataDog connector for Cortex XSIAM.

Show markdown source

@@ -1,2 +1,5 @@
 # DataDog
 
+Here are the articles in this section:
+
+* [datadog](datadog/datadog "mention") Configure the DataDog connector for Cortex XSIAM.

▸ DeHashed modified +7 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dehashed

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,9 @@

---

description: Configure the DeHashed connector for Cortex XSIAM.

---

# DeHashed

Here are the articles in this section:

• dehashed

Show markdown source

@@ -1,2 +1,9 @@
+---
+description: Configure the DeHashed connector for Cortex XSIAM.
+---
+
 # DeHashed
 
+Here are the articles in this section:
+
+* [dehashed](dehashed/dehashed "mention")

▸ DHS modified +7 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dhs

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,9 @@

---

description: Configure the DHS connector for Cortex XSIAM.

---

# DHS

Here are the articles in this section:

• dhs

Show markdown source

@@ -1,2 +1,9 @@
+---
+description: Configure the DHS connector for Cortex XSIAM.
+---
+
 # DHS
 
+Here are the articles in this section:
+
+* [dhs](dhs/dhs "mention")

▸ digicert modified +7 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/digicert

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,9 @@

---

description: Configure the digicert connector for Cortex XSIAM.

---

# digicert

Here are the articles in this section:

• digicert

Show markdown source

@@ -1,2 +1,9 @@
+---
+description: Configure the digicert connector for Cortex XSIAM.
+---
+
 # digicert
 
+Here are the articles in this section:
+
+* [digicert](digicert/digicert "mention")

▸ dnstwist modified +7 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dnstwist

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,9 @@

---

description: Configure the dnstwist connector for Cortex XSIAM.

---

# dnstwist

Here are the articles in this section:

• dnstwist

Show markdown source

@@ -1,2 +1,9 @@
+---
+description: Configure the dnstwist connector for Cortex XSIAM.
+---
+
 # dnstwist
 
+Here are the articles in this section:
+
+* [dnstwist](dnstwist/dnstwist "mention")

▸ Docker modified +8 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,10 @@

---

description: Configure the Docker data sources for Cortex XSIAM.

---

# Docker

Here are the articles in this section:

• connect-docker-hub-registry

• connect-docker-v2-compliant-container-registry

Show markdown source

@@ -1,2 +1,10 @@
+---
+description: Configure the Docker data sources for Cortex XSIAM.
+---
+
 # Docker
 
+Here are the articles in this section:
+
+* [connect-docker-hub-registry](docker/connect-docker-hub-registry "mention")
+* [connect-docker-v2-compliant-container-registry](docker/connect-docker-v2-compliant-container-registry "mention")

▸ Connect Docker Hub registry modified +1 −1 The cross-book link to Verify Registry Scanner connection became a broken-reference.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker/connect-docker-hub-registry

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -120,13 +120,13 @@ Security scanning in private networks is done using broker VM infrastructure whe

2. Find the Docker Hub instance from the list of 3rd Party Data Sources connectors, or use Search.

3. In the Docker Hub instance row, select View Details. The Docker Hub Instances page appears.

4. On the Docker Hub Instances page, you can filter results by any heading and value.

5. Select an Instance Name to open the details pane. The details pane contains the following granular information:

       <table><thead><tr><th width="166.32421875">Instance Details</th><th>Description</th></tr></thead><tbody><tr><td><strong>Status</strong></td><td>Shows the status of the connector: <strong>Connected</strong>, <strong>Error</strong>, <strong>Warning</strong>, <strong>Disabled</strong>, or <strong>Pending</strong>.</td></tr><tr><td><strong>Applet Status on Broker VM</strong></td><td>Shows the status of the <strong>Registry Scanner</strong> applet on the <strong>Broker VM</strong> page. This status is visible only when the Scan with <strong>Broker VM</strong> mode is selected.</td></tr><tr><td><strong>Repositories</strong></td><td>Shows the number of scanned repositories in the registry.</td></tr><tr><td><strong>Scan Mode</strong></td><td>Shows the selected scan mode for the data connector, such as <strong>Cloud Scan</strong>, <strong>Scan with Outpost</strong>, or <strong>Scan with Broker VM</strong>.</td></tr><tr><td><strong>Security Capabilities</strong></td><td>Shows a breakdown of the security capabilities enabled on the instance and their individual statuses. For example, select <strong>Registry Scanning</strong> when it shows a warning or error status to see the open errors and issues that contributed to the status.</td></tr></tbody></table>

       <table><thead><tr><th width="166.32421875">Instance Details</th><th>Description</th></tr></thead><tbody><tr><td><strong>Status</strong></td><td>Shows the status of the connector: <strong>Connected</strong>, <strong>Error</strong>, <strong>Warning</strong>, <strong>Disabled</strong>, or <strong>Pending</strong>.</td></tr><tr><td><strong>Applet Status on Broker VM</strong></td><td>Shows the status of the <strong>Registry Scanner</strong> applet on the <strong>Broker VM</strong> page. This status is visible only when the Scan with <strong>Broker VM</strong> mode is selected.</td></tr><tr><td><strong>Repositories</strong></td><td>Shows the number of scanned repositories in the registry.</td></tr><tr><td><strong>Scan Mode</strong></td><td>Shows the selected scan mode for the data connector, such as <strong>Cloud Scan</strong>, <strong>Scan with Outpost</strong>, or <strong>Scan with Broker VM</strong>.</td></tr><tr><td><strong>Security Capabilities</strong></td><td>Shows a breakdown of the security capabilities enabled on the instance and their individual statuses. For example, select <strong>Registry Scanning</strong> when it shows a warning or error status to see the open errors and issues that contributed to the status.</td></tr></tbody></table>

8. After the scan is complete, you can view the scanned images on the Container Images Inventory page. For more details, see Container Image assets.

    If you have selected the **Scan with Broker VM** option, then a **Registry Scanner** applet is created on the selected **Broker VM** or **Cluster**. For details, see [Verify Registry Scanner connection](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-registry-scanner#verify-registry-scanner-connection).

    If you have selected the **Scan with Broker VM** option, then a **Registry Scanner** applet is created on the selected **Broker VM** or **Cluster**. For details, see [Verify Registry Scanner connection](broken-reference).

Show markdown source

@@ -120,13 +120,13 @@ Security scanning in private networks is done using broker VM infrastructure whe
    2. Find the **Docker Hub** instance from the list of **3rd Party Data Sources** connectors, or use **Search**.
    3. In the **Docker Hub** instance row, select **View Details**. The **Docker Hub Instances** page appears.
    4. On the **Docker Hub Instances** page, you can filter results by any heading and value.
    5.  Select an **Instance Name** to open the details pane. The details pane contains the following granular information:
 
        <table><thead><tr><th width="166.32421875">Instance Details</th><th>Description</th></tr></thead><tbody><tr><td><strong>Status</strong></td><td>Shows the status of the connector: <strong>Connected</strong>, <strong>Error</strong>, <strong>Warning</strong>, <strong>Disabled</strong>, or <strong>Pending</strong>.</td></tr><tr><td><strong>Applet Status on Broker VM</strong></td><td>Shows the status of the <strong>Registry Scanner</strong> applet on the <strong>Broker VM</strong> page. This status is visible only when the Scan with <strong>Broker VM</strong> mode is selected.</td></tr><tr><td><strong>Repositories</strong></td><td>Shows the number of scanned repositories in the registry.</td></tr><tr><td><strong>Scan Mode</strong></td><td>Shows the selected scan mode for the data connector, such as <strong>Cloud Scan</strong>, <strong>Scan with Outpost</strong>, or <strong>Scan with Broker VM</strong>.</td></tr><tr><td><strong>Security Capabilities</strong></td><td>Shows a breakdown of the security capabilities enabled on the instance and their individual statuses. For example, select <strong>Registry Scanning</strong> when it shows a warning or error status to see the open errors and issues that contributed to the status.</td></tr></tbody></table>
 8.  After the scan is complete, you can view the scanned images on the **Container Images Inventory** page. For more details, see [Container Image assets](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/container-image-assets).
 
-    If you have selected the **Scan with Broker VM** option, then a **Registry Scanner** applet is created on the selected **Broker VM** or **Cluster**. For details, see [Verify Registry Scanner connection](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-registry-scanner#verify-registry-scanner-connection).
+    If you have selected the **Scan with Broker VM** option, then a **Registry Scanner** applet is created on the selected **Broker VM** or **Cluster**. For details, see [Verify Registry Scanner connection](broken-reference).
 
 <figure><img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FYuZqoJgEKHf1L7Estps0%2Fregistry-broker-vm.png?alt=media&#x26;token=7239ef79-a1a8-40cb-afe9-51fed4d841b0" alt=""><figcaption></figcaption></figure>
 
 <br>

▸ DocuSign modified +7 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docusign

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,9 @@

---

description: Configure the DocuSign connector for Cortex XSIAM.

---

# DocuSign

Here are the articles in this section:

• docusign

Show markdown source

@@ -1,2 +1,9 @@
+---
+description: Configure the DocuSign connector for Cortex XSIAM.
+---
+
 # DocuSign
 
+Here are the articles in this section:
+
+* [docusign](docusign/docusign "mention")

▸ Dropbox modified +4 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dropbox

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,8 +1,12 @@

---

description: Configure the Dropbox data source and connector for Cortex XSIAM.

---

# Dropbox

You can configure collecting Dropbox logs and data using a standard data source, content pack integration (onboarded prior to July 26, 2026), or connector (onboarded after July 26, 2026):

Collection Method│Description

| ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Standard data source overview│Forward different types of data from Dropbox Business accounts to Cortex XSIAM using the Dropbox data source.

Link to standard data source instructions│The following types of data can be ingested from Dropbox:

Log collection
- Events
Directory and metadata
- Member Devices
- Users
- Groups

For more information, see Ingest logs and data from Dropbox.

Link to standard data source instructions│The following types of data can be ingested from Dropbox:

Log collection
- Events
Directory and metadata
- Member Devices
- Users
- Groups

For more information, see Ingest logs and data from Dropbox.

Show markdown source

@@ -1,8 +1,12 @@
+---
+description: Configure the Dropbox data source and connector for Cortex XSIAM.
+---
+
 # Dropbox
 
 You can configure collecting Dropbox logs and data using a standard data source, content pack integration (onboarded prior to July 26, 2026), or connector (onboarded after July 26, 2026):
 
 | Collection Method                                                             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Standard data source overview                                                 | Forward different types of data from Dropbox Business accounts to Cortex XSIAM using the Dropbox data source.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | Link to standard data source instructions                                     | <p>The following types of data can be ingested from Dropbox:</p><ul><li><p>Log collection</p><ul><li>Events</li></ul></li><li><p>Directory and metadata</p><ul><li>Member Devices</li><li>Users</li><li>Groups</li></ul></li></ul><p>For more information, see <a href="dropbox/ingest-logs-and-data-from-dropbox">Ingest logs and data from Dropbox</a>.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

▸ Druva modified +7 −0 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/druva

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,2 +1,9 @@

---

description: Configure the Druva connector for Cortex XSIAM.

---

# Druva

Here are the articles in this section:

• druva

Show markdown source

@@ -1,2 +1,9 @@
+---
+description: Configure the Druva connector for Cortex XSIAM.
+---
+
 # Druva
 
+Here are the articles in this section:
+
+* [druva](druva/druva "mention")

▸ Microsoft 365 (Posture) modified +1 −1 Its link to the Cloud Posture onboarding instructions became a broken-reference when that copy was deleted.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-365-posture

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,9 +1,9 @@

# Microsoft 365 (Posture)

You can configure collecting Microsoft 365 (Posture) logs using a Cloud Posture and Runtime Security data source or connector:

Collection Method│Description

| ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Cloud Posture and Runtime Security data source overview│Forward Microsoft 365 (Postrure) logs to Cortex XSIAM using the Microsoft 365 data source.

Link to Cloud Posture and Runtime Security data source instructions│How to onboard Microsoft 365

Link to connector details│• Microsoft 365
• Microsoft365
• Microsoft Entra ID

Show markdown source

@@ -1,9 +1,9 @@
 # Microsoft 365 (Posture)
 
 You can configure collecting Microsoft 365 (Posture) logs using a Cloud Posture and Runtime Security data source or connector:
 
 | Collection Method                                                   | Description                                                                                                                                                                      |
 | ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Cloud Posture and Runtime Security data source overview             | Forward Microsoft 365 (Postrure) logs to Cortex XSIAM using the Microsoft 365 data source.                                                                                       |
-| Link to Cloud Posture and Runtime Security data source instructions | [How to onboard Microsoft 365](../../cloud-posture-and-runtime-security-data-sources/how-to-onboard-microsoft-365)                                                               |
+| Link to Cloud Posture and Runtime Security data source instructions | [How to onboard Microsoft 365](broken-reference)                                                                                                                                 |
 | Link to connector details                                           | <p>• <a href="broken-reference">Microsoft 365</a><br>• <a href="microsoft-office-365/microsoft365">Microsoft365</a><br>• <a href="microsoft-entra-id">Microsoft Entra ID</a></p> |

▸ Extended Threat Intelligence modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,12 +1,12 @@

---

description: >-

Research threats, investigate indicators, and apply intelligence across Cortex

Explore Extended Threat Intelligence in Cortex XSIAM to research threats,

XSIAM workflows.

investigate indicators, and strengthen security workflows.

---

# Extended Threat Intelligence

Extended Threat Intelligence (XTI) offers operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform.

This screenshot from Cortex UI shows the XTI Threat Intel Library page listing threat actors.

Show markdown source

@@ -1,12 +1,12 @@
 ---
 description: >-
-  Research threats, investigate indicators, and apply intelligence across Cortex
-  XSIAM workflows.
+  Explore Extended Threat Intelligence in Cortex XSIAM to research threats,
+  investigate indicators, and strengthen security workflows.
 ---
 
 # Extended Threat Intelligence
 
 Extended Threat Intelligence (XTI) offers operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform.
 
 <figure><img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FfgqohfZlHMei5r9mobRS%2Funknown.png?alt=media&#x26;token=d63be7a9-dc9a-4afe-b999-2ec139433e8e" alt="This screenshot from Cortex UI shows the XTI Threat Intel Library page listing threat actors." height="411" width="624"><figcaption></figcaption></figure>

▸ Threat intel context in cases and issues modified +2 −2

xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-context-in-cases-and-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,12 +1,12 @@

---

description: >-

Analyze indicator intelligence and Behavioral Threat Analysis (BTA) findings

Use Cortex XSIAM threat intelligence context to analyze indicators and

in cases and issues.

Behavioral Threat Analysis findings in cases and issues.

---

# Threat intel context in cases and issues

Cortex identifies indicators from your existing detections generated by other modules. The system extracts these indicators at the issue level and aggregates them at the case level.

When an indicator is associated with an issue, you can view the threat intelligence context in the case and in the issues grouped under it, as follows.

Show markdown source

@@ -1,12 +1,12 @@
 ---
 description: >-
-  Analyze indicator intelligence and Behavioral Threat Analysis (BTA) findings
-  in cases and issues.
+  Use Cortex XSIAM threat intelligence context to analyze indicators and
+  Behavioral Threat Analysis findings in cases and issues.
 ---
 
 # Threat intel context in cases and issues
 
 Cortex identifies indicators from your existing detections generated by other modules. The system extracts these indicators at the issue level and aggregates them at the case level.
 
 When an indicator is associated with an issue, you can view the threat intelligence context in the case and in the issues grouped under it, as follows.

Documentation — August 27, 2026

Cloud posture onboarding pages retire into the vendor tree; new DSPM Database applet page

Highlights

Changes