Activate DSPM Fileshare - Learn more about activating a Broker VM with the DSPM Fileshare applet. - Administrator Guide - Cortex XSIAM - Cortex

Activate DSPM Fileshare - Learn more about activating a Broker VM with the DSPM Fileshare applet. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-11

Notice

This feature is included with a Cortex XSIAM Premium license. It is also included with a Cortex XSIAM NG SIEM and Cortex XSIAM Enterprise license that has the Cloud Posture Security or Cloud Runtime Security add-on.

Danger

Set up and configure Broker VM
Know the complete path to the files and folders that you want Cortex XSIAM to monitor.
Necessary user permissions to access the network shares. For the SMB connection type, you need the user name and password.

How to activate the DSPM Fileshare applet

Select Settings → Configurations → Data Broker → Broker VMs.
On the Brokers tab, find Broker VM, and in the APPS column, click + ADD. In the list of applets, click DSPM Fileshare.
Note
The applet list displays only the applets for which you have permissions.

Configure the DSPM Fileshare settings according to the following steps.

Field	Description
Connection Type	NFS (Network File System): A distributed file system protocol that lets networked computers share files remotely, making them appear as if they're stored locally. Operating at the application layer, it uses Remote Procedure Calls (RPCs) for clients to access a server's files and directories. SMB (Server Message Block): A network file-sharing protocol that provides shared access to resources like files, printers, and serial ports across a network. It enables client applications to remotely interact with files and other assets stored on a server. It is the default file-sharing protocol for Microsoft Windows operating systems. This connection type requires a username and a password.
Path	Specify the host and path to the folder containing the files that you want Cortex Cloud Data Security to monitor.
Username	For the SMB connection type only.
Password	For the SMB connection type only.
Test Connection	Select to validate the connection permissions.

Note

By default, all configured connections are saved.

On the File Share Connection screen, click + Add a Connection.
Note
For details regarding the connection fields, see the table above under File Share Connection.
In the File Share Connection field, replace the text with a name for the new connection.
Select a connection type.
Provide the path to the shared folder (the host and path).
For SMB connections only, provide a username and password.
Optionally, do the following:
1. Turn on the Classification toggle. This enables 2,500 random files to be scanned and classified each time.
2. In the Scan every list, select the cadence of how often the files are to be scanned. If you want the scans to occur less frequently, choose the Custom option and enter the amount of days, weeks, or months that you require.
Click Test Connection to ensure the connection works properly.
Click Save.

Note

You can add multiple connections under a single instance of the DSPM Fileshare applet by returning to the File Share Connection screen and clicking Add Connection. Each new connection can be of either the NFS or SMB connection type.