Cortex XSIAM Discussions | Palo Alto Networks

Welcome to the Cortex XSIAM Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

XSIAM Integration Web Server

Hi,I want to create an Integration that start a simple web server with a single button for example that print "Hello World".There is the out of the box integration "Generic Export Indicators Service" I want it to be based on that (With Long Running instance, Nginx etc..)I have tried to do so but I couldnt make it work.Would love to get some help...

Cloud Identity Engine - CIE

Hi, Is anyone using Cloud Identity Engine in XSIAM? How useful is it, and could you share your use case and experience? Thanks

Azure XSIAM

How is on-boarding logs using Microsoft Azure integration different from using the Azure Event hub integration? https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-3.x-Documentation/Onboard-Microsoft-Azure https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Ingest-Logs-from-Microsoft-Azure-Event-H...

IOC Exclusion for when an IOC was denied by the FW

Hi All, so when an IOC is added for an IP address for example in XSIAM, and a FW logs containing this IP is ingested to XSIAM, then XSIAM will auto create an alert for this IOC regardless if dropped or allowed by the FW.. it detect this IOC and creates an alert. has anyone found a solution for IOC not to trigger when the FW action has already...

Resolved! bulk close issues

Hello teamI have the following scenario of 16K open issues and I would like to perform mass closure of these open cases. Is there any way to do this? i tried to build a playbook which i give it the excel sheet of all the issues IDs and start bulk resolve but i have problem with it , it is very slow , i mean it takes 24 hours for just close 4K is...

Resolved! XSIAM Analytics rules Dashboard

Is there anyway to create a widget used on a dashboard that shows me all the enabled analytics rules in xsiam? Cortex XSIAM

Resolved! XSIAM - Data Patterns

Hi. Please, a question about Data Patterns in Cortex XSIAM. Once the connection from the Broker VM to the Windows server (SMB) is configured, the connection is verified and displayed under Modules -> Data Security -> Storage Buckets, how is it linked to previously created Data Patterns and Data Profiles?. Thank you in advanced. Regards.

Username Generalization Playbook

Hey all, i'm hoping that someone has already started something like this and can get me a few steps past the starting line but as we know, in a corporate environment, there are various ways that usernames come across (abc123, first.last, domain/abc123, domain/first.last, fqdn....etc) from different log sources. This creates complexity for playbo...

XSIAM Content Update Notifications pack

Hi, has anyone deployed this to date and have it working? just started looking at this as a means to notify our platform team when we need to perform content updates etc as we manage a number of xsiam tenants.. and out the box both the playbooks fails, so would imagine some customization is needed. the deployment documentation is sparse at bes...

Resolved! UEBA Capabilities

Hi All, I'm looking for some guidance around UEBA capabilities in XSIAM. Currently, we are using the free trial version of the ITDR module in XSIAM. If we do not have ITDR module license , what are the ways to enhance UEBA capabilities in XSIAM?. Should we manually develop UEBA pattern-related use cases using telemetry logs? Appreciate your...

XQL Query for calculating XDR log ingestion

Hi, As this is covered by the XDR license and not visible in the data ingestion widgets.. Does anyone have a query to look at data ingestion for XDR agents only? thanks in adv

AI Prompt Feature | XSIAM Version 3.4

Hi All, Does anyone tested the AI prompt feature in XSIAM version 3.4? From our experience, only generic prompts seem to be working. When we try to use specific real-time case or issue data, it doesn't respond as expected. We haven't been able to test out-of-the-box or custom prompts using input data like Issue ID or Issue Name, as the AI prompt...

Resolved! Broker VM cluster - syslog ingestion

Hi We have activated the Syslog Collector for the broker VM cluster. Do you have any recommendations on how to verify that it is functioning correctly? Thanks!

XDRC Connection Error

Hello experts, I have two XDRC installed on W2016 server, both are connected through same BrokerVM. Even tried test if the BVM and XDRC connection was fine, I did a test to run "uninstall collector" from Console, it was successful. From XDRC Adminsitration, The status shown :Warning, however, the last seen was up to date. From XQL queries...

XSIAM Playbook

Hi, I want to run one basic playbook automation on every new issue trigged. For example, I have specific conditions where, if a new issue meets those conditions, its severity should be updated. Currently, only one automation rule can be applied to each issue. While using a Job is an option, I am interested to know if there are any other solution...

Discussions

Welcome to the Cortex XSIAM Discussions!

XSIAM Integration Web Server

Cloud Identity Engine - CIE

Azure XSIAM