XSOAR Packs compatible with XSIAM

[I.Schisel]

I have been digging into the marketplace more recently specifically with the TIM add-on. I noticed that the marketplace shows multiple different playbooks for the "TIM - Indicator Auto-Processing" pack on the marketplace website. However inside of the xsiam console. The marketplace only shows one playbook. Are the playbooks cross compatible? Are they redundant? Why is there such a disconnect?

[susekar]

Hello @I.Schisel ,

Greetings for the day.

The disconnect you observed between the Cortex Marketplace website and the internal XSIAM console is intentional and relates to how Cortex XSIAM handles Threat Intelligence Management (TIM) compared to Cortex XSOAR.

Why Is There a Disconnect?

The Cortex Marketplace website is a universal catalog that serves multiple products, including Cortex XSOAR and Cortex XSIAM. Because these platforms have different underlying architectures, the marketplace within the XSIAM console automatically filters content to display only what is relevant and supported for the XSIAM platform.

Are the Playbooks Redundant?

Yes, for most XSIAM users, the playbooks within the “TIM – Indicator Auto-Processing” content pack are redundant.

• Native Engine:
  In Cortex XSIAM, TIM processing—including indicator scoring, expiration, enrichment, and stitching—is handled by a built-in native engine.

• XSOAR Requirement:
  In Cortex XSOAR, these tasks often require playbook-based automation to manage the indicator lifecycle. Since XSIAM performs these actions automatically in the backend, the TIM processing playbooks available in the marketplace are not required for standard XSIAM operations.

•  

Are They Cross-Compatible?

Although XSIAM is built on XSOAR foundations and can execute many XSOAR playbooks, TIM-specific processing playbooks are commonly hidden or excluded in XSIAM to avoid conflicts with the native TIM engine. Using these playbooks in XSIAM is generally discouraged unless you have a highly customized use case that cannot be addressed by native functionality.

Recommendations

• Rely on Native Features:
  Use the built-in Threat Management capabilities within the XSIAM console for indicator handling rather than external processing playbooks.

• Focus on Feed Integrations:
  Prioritize installing Feed integrations from the Marketplace. These feeds supply raw threat intelligence data that the XSIAM engine processes automatically.

• Check “Show Adopted”:
  If you expect to see a playbook in the Playbook Catalog, ensure the Show Adopted option is enabled, as the catalog defaults to displaying only unadopted content.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar