Data Inventory - Gain insights into the data sources integrations and endpoints that are ingesting data into Cortex XSIAM. - Administrator Guide - Cortex XSIAM - Cortex

Data Inventory - Gain insights into the data sources integrations and endpoints that are ingesting data into Cortex XSIAM. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-04

Category

Administrator Guide

Abstract

Gain insights into the data sources integrations and endpoints that are ingesting data into Cortex XSIAM.

The Data Inventory provides a dynamic view of the data sources that are ingesting data into Cortex XSIAM. You can see breakdowns of data ingestion by data source, ingestion rates, trends, and prevented events.

You can access the dashboard from the XSIAM Command Center by clicking a data source, the number of Endpoints or VM Brokers/XDRCs. The Data Inventory includes incoming data sources and key performance indicators. The following table describes each of these sections:

Section	Details
Data sources	Data sources are broken down into categories. Depending on the selected data source, the dashboard opens the relevant category. You can expand a category to see details of individual data sources and hover over a data source to see more details. You can also click on a data source to link to a drill down view, filtered by your selection: Connected endpoints PANW integrations 3rd party data sources Only registered Cortex XSIAM data sources are displayed in this view. To register a data source, install the relevant integration in the Marketplace.
Key performance indicators	Event Ingestion and Data Ingestion display the amount of data and events ingested during the time frame and the ingestion rate. The trend percentages for the key performance indicators are calculated by comparing the totals from the current time frame with the totals of the previous time frame. An arrow indicates whether the rates are rising or falling in comparison to the previous time frame's total. Collection errors displays the number of collection errors that occurred in the time frame. Collection errors occur when integration instances that fetch data have an error status. Click on the key performance indicators to drilldown to dedicated pages for further investigation.

Section

Details

Data sources

Data sources are broken down into categories. Depending on the selected data source, the dashboard opens the relevant category. You can expand a category to see details of individual data sources and hover over a data source to see more details. You can also click on a data source to link to a drill down view, filtered by your selection:

Connected endpoints
PANW integrations
3rd party data sources
Only registered Cortex XSIAM data sources are displayed in this view. To register a data source, install the relevant integration in the Marketplace.

Key performance indicators

Event Ingestion and Data Ingestion display the amount of data and events ingested during the time frame and the ingestion rate.
The trend percentages for the key performance indicators are calculated by comparing the totals from the current time frame with the totals of the previous time frame. An arrow indicates whether the rates are rising or falling in comparison to the previous time frame's total.
Collection errors displays the number of collection errors that occurred in the time frame. Collection errors occur when integration instances that fetch data have an error status.

Click on the key performance indicators to drilldown to dedicated pages for further investigation.