Documentation — August 30, 2026

476 files changed, 3248 insertions, 310 deletions — view the commit on the mirror.

New Microsoft 365 connector supersedes the legacy one; Cortex Data Security moves out of Cloud Security

A new Microsoft 365 connector page lands with full setup steps; the old page is renamed Microsoft365 (legacy) and gets a migration guide.
Cortex Data Security moves from Cloud Security into its own section, and its licence hint now names a Data Security licence or add-on.
A 2,000-field limit per dataset is documented, together with a new fields stage for the INGEST section of a parsing rule to work around it.
Four SaaS connectors — Microsoft 365, Microsoft Teams, Google Workspace and Anthropic Claude — replace “follow the configuration wizard” with prerequisites, API scopes and task-by-task setup.
Most of the 477 files are a metadata sweep: 409 pages gained a front-matter description and 130 section landing pages swapped link tables for bullet lists.

Highlights

The Microsoft 365 connector is replaced, not revised

The old page is deleted and rewritten as Microsoft 365 (new) with 124 lines of setup; the previous connector is renamed Microsoft365 (legacy) and carries a warning pointing at the new one.
Migrating off the legacy Microsoft365 connector clears its inventory for about 24 hours

The new migration page says you must remove the old connector first, which clears discovered Microsoft 365 assets from the Data Security inventory, and that the initial re-sync can take days to weeks.
Cortex Data Security is now its own section and its licensing line changed

The page moved from cloud-security/ to data-security/, and "Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license" became "Requires a Data Security, Cloud Runtime Security, or Cortex XSIAM Premium license, or the Data Security add-on".
Datasets are capped at 2,000 fields, and a new parsing-rule stage exists to stay under it

Past the cap Cortex XSIAM stops parsing and saves the raw log; a new `fields` stage in the `INGEST` section lets a parsing rule pick which fields to keep so automatic parsing resumes.
Enhanced Application Logs and Cortex Audit Logs are documented as non-billable ingestion

A new section on the Data Ingestion dashboard page states both are still ingested and analyzed but excluded from the licensed daily quota, and the reference adds Daily Quota Consumption and Top Data Sources widgets.
Cortex XDR agent 9.0 and 9.0.1 are archived as end of life

Both were added to the past-releases archive with an EOL date of August 23, 2026.

Bulk change — 476 files. Per-file diffs are not stored for a change this size; view it on the mirror.

Changes

476 files listed, 15 written up and shaded below.

▸ ▾ Discovery Engine modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets/discovery-engine

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Asset classes modified +1 −4 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ AI assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/ai-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ API assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/api-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Application assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/application-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Code and Supply Chain Security assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ CI/CD instances assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/ci-cd-instances-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ CI/CD pipeline assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/ci-cd-pipeline-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ IaC resources assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/iac-resources-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Repository assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/repository-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Software package assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/software-package-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ VCS organization assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/vcs-organization-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Compute assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Container image assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/container-image-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Serverless functions assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/serverless-functions-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ VM images assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/vm-images-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Data assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/data-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Device assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/device-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ External Surface assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Certificate assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/certificate-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Domain assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/domain-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ External Surface attribution evidence modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/external-surface-attribution-evidence

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Service assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/service-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Website assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/website-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Identity assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/identity-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Network assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/network-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Security services assets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/security-services-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Asset configurations modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Application criteria modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/application-criteria

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Asset Roles modified +1 −3 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage Asset Roles for Endpoints modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-endpoints

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage Asset Roles for Users modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-users

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Honey user modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-users/honey-user

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Asset groups modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-groups

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Asset inventory overview modified +1 −3 xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-inventory-overview

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage Risk Scores modified +1 −4 xsiam/detect-investigate-and-respond-to-threats/asset-management/manage-asset-scores

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Query the asset inventory via XQL modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/query-the-asset-inventory-via-xql

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Vulnerability Assessment modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/asset-management/vulnerability-assessment

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ ASM enrichment of cloud assets modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/asm-enrichment-of-cloud-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Attack surface assets modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-assets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Attack Surface Testing modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/attack-surface-testing

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Digital Risk Protection modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/digital-risk-protection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Externally inferred CVEs modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/externally-inferred-cves

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Deploy ASM and Exposure Management enrichment and remediation automation modified +1 −1 xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/deploy-asm-and-exposure-management-enrichment-and-remediation-automation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Emerging Vulnerabilities modified +2 −1 xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/emerging-vulnerabilities

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Global Lookup modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/global-lookup

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Advanced Email Security modified +3 −1 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Advanced Email Security module security and compliance modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/advanced-email-security-module-security-and-compliance

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Automate remediation for the Cortex Advanced Email Security module modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Email Remediation Response Rules modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module/email-remediation-response-rules

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Email Security Remediation Action Center modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module/email-security-remediation-action-center

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Advanced Email Security module architecture and data flow modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-architecture-and-data-flow

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Advanced Email Security module overview modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-overview

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Advanced Email Security threat detection and issues modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-threat-detection-and-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Email Security Analytics Rules modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-threat-detection-and-issues/email-security-analytics-rules

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Deploy and configure the Email Security module modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/deploy-and-configure-the-email-security-module

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Email Command Center modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/email-command-center

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Getting started with the Cortex Advanced Email Security module modified +3 −1 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/getting-started-with-the-cortex-advanced-email-security-module

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate and respond to email security issues modified +3 −1 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/investigate-and-respond-to-email-security-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Mailbox Inventory modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/mailbox-inventory

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Malicious Email Inventory modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/malicious-email-inventory

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Exposure management modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/exposure-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Network Scanner modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/exposure-management/cortex-network-scanner

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Exposure Management Command Center modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/exposure-management/exposure-management-command-center

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Learn about Exposure Management modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/exposure-management/exposure-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Get started with Exposure Management modified +1 −1 xsiam/detect-investigate-and-respond-to-threats/exposure-management/get-started-with-exposure-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Ingest assets and vulnerabilities from third-party applications modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/exposure-management/ingest-assets-and-vulnerabilities-from-third-party-applications

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Security controls modified +2 −2 xsiam/detect-investigate-and-respond-to-threats/exposure-management/security-controls

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Identity Threat Detection and Response (ITDR) modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Improve Active Directory posture with AD-SPM modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/active-directory-security-posture-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage user asset roles modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/asset-roles

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enforce dynamic access control with CAP modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/conditional-access-policy

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Get started with ITDR modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/get-started-with-itdr

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate user risk modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/investigate-user-risk

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage role based access control (RBAC) in ITDR modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/manage-role-based-access-control-rbac-in-itdr

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Monitor user risk exposure modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/monitor-user-risk-exposure

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Prevent malicious LDAP queries modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/prevent-malicious-ldap-queries

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Additional case actions modified +6 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ XQL macros modified +1 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/xql-macros

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue investigation actions modified +14 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Overview of cases modified +19 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Monitor dashboards and reports modified +20 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Access and visibility for dashboards and reports modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Access and sharing cheat sheet modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Access to widgets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-to-widgets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Sharing icons modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/sharing-icons

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Visibility settings modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/visibility-settings

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Advanced configuration modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Configure drilldowns modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-drilldowns

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Configure global filters modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-global-filters

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create custom widgets modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Add parameters to a custom XQL widget modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/add-parameters-to-a-custom-xql-widget

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create script-based widgets modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-script-based-widgets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create widgets using AI modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-widgets-using-ai

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create XQL widgets modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create dashboards modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a dashboard modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards/create-a-dashboard

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create reports modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a report template from scratch modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports/create-a-report-template-from-scratch

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Dashboard reference modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.