Cortex XSIAM onboarding checklist - Review the steps to deploy and onboard Cortex XSIAM. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

1. Activation and initial setup

✓ In the Cortex Gateway, activate Cortex XSIAM and confirm license status.

✓ Enable access to required PANW resources and set up encryption keys (BYOK), if required.

✓ Assign initial administrator and analyst-type user roles (Responder/Investigator), create user groups, and assign roles to those groups (recommended) to a limited number of users initially. You can update this later.

✓ Set up access through the Customer Support Portal or SAML single sign-on.

Activate Cortex XSIAM

Enable access to required PANW resources

Set up users, groups, and roles

Set up authentication

2. Configure content

Use the Data Sources Onboarding wizard to configure the following:

✓ Priority content:

✓ Highly recommended content:

3. Deploy the XDR agent

✓ Install the XDR agent by creating XDR Agent installation packages for a small, diverse pilot group of endpoints and deploy the agent to a pilot group (phased rollout). Start with small, low-risk endpoints and extend, as required. Gradually expand agent distribution to larger groups that have similar attributes (hardware, software, and users). At the end of two weeks, you can have Cortex XSIAM deployed on up to 100 endpoints.

✓ After testing expected agent behavior and performance, review and select default endpoint security profiles (Exploit, Malware, Restrictions, Agent Settings, Exceptions) to begin protecting your endpoints from threats immediately. Once endpoints are deployed and start collecting data, you can make any necessary adjustments to these rules and policies.

✓ Verify endpoint data collection (logs, alerts, events) is flowing from deployed agents to the XSIAM Data Lake. After deploying the agents to the pilot group, set up data collection to analyze the data.

This provides granular event data (process execution, file activity, registry changes, network connections) necessary for EDR/XDR detection and Behavioral Indicators of Compromise (BIOCs).

4. Enable Analytics and Identity Analytics

✓ Enable Cortex XSIAM Analytics engine (if not already enabled).

The analytics engine accesses your logs as they are streamed to Cortex XSIAM, including firewall data, and analyzes them as soon as they arrive.

✓ Enable Identity Analytics, which focuses on user behavior that is critical since attackers primarily target credentials. It has two main functions:

✓ Enable the Identity Threat Detection and Response (ITDR) add-on (optional), which enhances the analytics baseline capabilities to include the Directory Infrastructure. This enables the detection of advanced attacks targeting Domain Controllers and other identity components.

In addition, the ITDR module integrates proactive capabilities by using attack surface management to identify and expose identity-related security flaws and vulnerabilities before they can be exploited.