What is the difference between Market Place , Data source and XDR collectors in XSIAM

[NivedaR]

Same as the title. Could you please give examples of how Market Place, Data source, and XDR collectors are in XSIAM in terms of ingesting data?

[LancePettay]

Hi, Niveda!

Here is an explanation for each of the items you mentioned. When onboarding a new data source, I recommend following these in the order I've described below.

1. Data Sources
   1. This is the first place you should start when onboarding a data source. It ties into the marketplace directly and will automatically download any packs needed for a particular data source as well as assist you with the configuration. This makes the onboarding process much easier.

   2. There is also some helpful information available in our documentation:

      https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Adding-a-ne...

2. Marketplace
   1. Occasionally, a data source will not be supported by the data source onboarder (above), so you will need to search for it in the marketplace directly. There are also many other packs in the marketplace that are not exclusively related to data sources. Once installed, any packs with an integration with another product can be found under Settings>Configurations>Data Collection>Automation & Feed Integrations. This includes those that came from the data source onboarder.
3. XDR Collectors
   1. In the event you have a data source which is not available through the other methods above, XDR Collectors are one available option for getting that data by placing an XDR Collector directly on a server. I cannot cover all of the details around XDR Collectors here alone, so check out our documentation on the subject: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/XDR-Collect...
   2. As well as additional methods for external data ingestion: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/External-Da...

I hope this helps!

- Lance