This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSIAM Discussions
Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSIAM Discussions
Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.
About Cortex XSIAM Discussions
Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.

Discussions

Start a conversation

Welcome to the Cortex XSIAM Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 2861 Views
  • 0 replies
  • 0 Likes

XSIAM Report

What do “Restricted” and “Public” actually mean in an XSIAM report template? If I set the report template I created to “Restricted,” does that mean I won’t be able to schedule the report to be sent to an external email address, and that it will only work when I manually generate it within XSIAM?

Broker-VM Upgrade to Debian pre-feb 2026 Deployments

Has anyone done this to date? Eventhough we are running version 31.0.58 (latest at the current time) is there an easy way to determine if running Ubuntu without having to Live terminal to the BVM? (waiting on client to open 'https://lrc-<region>.paloaltonetworks.com' to enable live terminal access) https://docs-cortex.paloaltonetworks.co...

PA_nts by • L4 Transporter
  • 130 Views
  • 1 replies
  • 0 Likes

XSIAM Hash Search for WildFire

Hi, I wanted to know if there is a way or any api paths to be able to query for hashes for the WildFire Reports- Basically, achieving this capabilities but using API and not from GUI, I couldnt find anything that matches this in their - public_api/v1

Bar_Magnezi_0-1783313263756.png

Resolved! Cortex XSIAM broker vm

Our Cortex XSIAM agents connect to the XSIAM server exclusively via the Broker VM's local agent proxy settings applet, as direct outbound internet/server access is blocked for these endpoints. If we want our agents to auto-upgrade, do we absolutely have to enable and configure the 'Agent Installer and content caching' part of the applet on the B...

Open Telemetry - OTLP

Has any XSIAM tenant had a plan to utilize OpenTelemetry Collectors to populate data into a VM Broker or any other method to utilize logs sourced via OTLP? Technically could convert the OTLP to syslog out to VMBroker but not sure yet what is lost in that.

T.Szozda by • L0 Member
  • 123 Views
  • 1 replies
  • 0 Likes

Options to parse Syslog messages containing linebreaks

Hello everyone! I am facing a problem and hope someone can provide me with answers I have yet to find.I am parsing syslog data into XSIAM, from a certain kind of our systems.One of the entries in the original data for one of these systems may contain a linebreak (\n).As this linebreak is not (properly?) escaped, this breaks the original messag...

Resolved! How to create Business Units?

Hello, Team. I want to add new assets to my XSIAM deployment. I found that this can be done by creating a special CSV file (https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-3.x-Documentation/Upload-or-remove-ASM-assets). However, the “Business Units” column is required in this table. But we don’t have any Business Units (we c...

How to exclude a legitimate signed process from Anti-Ransomware Protection (Suspicious File Modification) in block mode?

Hi all, We get a false positive on Cortex XSIAM: Alert: Suspicious File Modification Module: Anti-Ransomware Protection Process: jpconsole.exe (OpenText Blazon), signed by Open Text Corporation, WildFire = Benign It is a legitimate app that modifies many files normally, so it looks like ransomware. We are in Report mode now and want to move to B...

DNS Analytical Logs

Hi Everyone, I need some assistance integrating DNS Analytical Logs into XSIAM. I have tried collecting these logs using an XDR Collector and other available methods, but so far I have not found a supported approach. This requirement is quite urgent, and I would appreciate any guidance from anyone who has successfully integrated DNS Analytical L...

M.Harne by • L1 Bithead
  • 437 Views
  • 3 replies
  • 0 Likes

Resolved! life of a case

Hi all, I am trying to figure out the life of a case and run into a question I can't seem to find the documentation about:What happens when a case has been set to resolved but a new matching issue pops up? Is a new case created or is the resolved case re-opened?

  • 174 Posts
  • 45 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks