This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSIAM Discussions
Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSIAM Discussions
Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.
About Cortex XSIAM Discussions
Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.

Discussions

Start a conversation

Welcome to the Cortex XSIAM Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 2948 Views
  • 0 replies
  • 0 Likes

Resolved! XSIAM HTTP Log Collector Testing

Hello everyone, We are currently considering to us a HTTP Log Collector. However, before this can be started, I wanted to test the collection. Now, in theory, this should not be hard, due to the examples provided after setting up the integration. Nonetheless, either the Python Example is faulty in some way, or I am being exceedingly stupi...

Firefox crashes when opening xsiam tenant

Just gauging if just me or anyone having similar issues since a few days now.. suspect after either Windows or FF update recently. Everyone else in FF is fine.. just not XSIAM. Edge works and forced to use it now 😞 When I log into a XSIAM tenant ( i have multiple) via FF, it loads then crashes with following message: 'Gah. Your tab just cras...

PA_nts by • L4 Transporter
  • 92 Views
  • 1 replies
  • 0 Likes

XSIAM logs from Palo Alto Firewall using syslog

https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector Why does the official guide only highlight Custom Formats for Traffic, Threat, URL, and File data logs? What about other NG...

TrendMicro Apex One Alert mapping into XSIAM

Hi All Has anyone done this to date and willing to share their Correlation XQL logic used to map alerts from Apex One into XSIAM? I have done this for a few others already like Crowdstrike, MS Graph API etc but having issues with time to navigate through all the raw log data to determine the required fields to validate and alert on what is requi...

PA_nts by • L4 Transporter
  • 131 Views
  • 0 replies
  • 1 Likes

XSIAM documentation in PDF form

Is there any spot where I can just download the documentation for the "admin" guide or the XQL reference that isn't just printing the web page to a PDF? Trying to use the new search function which forces the AI agent is not a pleasant experience for me.

Crowdstrike Integration to XSIAM

Hi All, We are running XSIAM with the Crowdstrike Falcon content pack installed, the parsing and datamodeling works.. data is ingesting etc etc.. however we are not seeing any alerts being generated as yet.. the content pack does not include a realtime correlation rule to pull and map alerts into xsiam. Has anyone done a custom correlation rul...

PA_nts by • L4 Transporter
  • 446 Views
  • 4 replies
  • 0 Likes

Broker-VM disconnet alert notification

Hi All, anyi dea how i can generate an alert when a broker-vm gets disconnected? Has anyone managed to create a correlation rule that will alert if a Broker-VM gets disconnected from XSIAM? the xsiam documentation states that 'To help you monitor your Broker VM version, connectivity, and high availability clusters, Cortex XSIAM sends notifi...

PA_nts by • L4 Transporter
  • 1707 Views
  • 5 replies
  • 0 Likes

Resolved! XSIAM - API Get Correlation Rules - Least Priviledge

In the API reference, it states that you must have Instance Administrator permissions to run the endpoint /public_api/v1/correlations/get. Is it possible to create a custom role for the API key that has sufficient permissions to execute this endpoint? Do you know any other way to retrieve the query from a specific correlation rule? Cortex XSI...

Parsing rule and data model Rule

Hi Everyone, We are currently ingesting syslog data from our Aruba switches into Cortex XSIAM/XDR using the HPE Switch content pack, but the logs are not automatically normalizing into XDM fields. In our environment, when we query other datasets like Office 365, Zscaler, or AWS, the logs are automatically parsed and normalized into xdm.* fields ...

Long Running Integration

Is it possible in xsiam to make a custom data collection integration use the long running integration option (https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Developer-Guide/Long-Running-Containers) or is that only available for integrations that palo alto networks provides? Is this an effective way to get over the 10min doc...

Resolved! ServiceNow CMDB data to XSIAM

Hi, We have integrated XSIAM with ServiceNow CMDB. We want to pull critical assets from the CMDB into XSIAM using an API and we have to do feature field configuration for these critical assets. Currently, I only see an option to upload a static file in the feature field configuration ( Host/ User/IPaddress) Could someone please help with the fol...

Resolved! XSIAM Report

What do “Restricted” and “Public” actually mean in an XSIAM report template? If I set the report template I created to “Restricted,” does that mean I won’t be able to schedule the report to be sent to an external email address, and that it will only work when I manually generate it within XSIAM?

Broker-VM Upgrade to Debian pre-feb 2026 Deployments

Has anyone done this to date? Eventhough we are running version 31.0.58 (latest at the current time) is there an easy way to determine if running Ubuntu without having to Live terminal to the BVM? (waiting on client to open 'https://lrc-<region>.paloaltonetworks.com' to enable live terminal access) https://docs-cortex.paloaltonetworks.co...

PA_nts by • L4 Transporter
  • 299 Views
  • 1 replies
  • 0 Likes

XSIAM Hash Search for WildFire

Hi, I wanted to know if there is a way or any api paths to be able to query for hashes for the WildFire Reports- Basically, achieving this capabilities but using API and not from GUI, I couldnt find anything that matches this in their - public_api/v1

Bar_Magnezi_0-1783313263756.png
  • 181 Posts
  • 45 Subscriptions
Top Solution Authors
View All
Top Liked Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks