Plan and prepare - Learn more about deployment considerations and onboarding steps. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Determine the required Log storage

✓ Determine the amount of log storage you need for your Cortex XSIAM deployment. Discuss with your partner or sales representative to determine whether to purchase additional storage within the Cortex XSIAM tenant.

Data storage lifecycle

Determine the deployment region

✓ Determine the region you want to host Cortex XSIAM and any associated services, such as the Directory Sync Service. If you plan to stream data from a Strata Logging Service instance, it must be in the same region as Cortex XSIAM.

Cortex XSIAM supported regions

Review your license and add-ons

✓ Review your Cortex XSIAM license and consider the addons for your use case, such as Advanced Email Security and Exposure management for complete security protection.

Cortex XSIAM product licenses

Plan the XDR Agent deployment

✓ The XDR Agent is installed on endpoints for protection and extended detection and response (XDR). The data is collected into the Cortex XSIAM tenant.

For Cortex XSIAM Premium or XSIAM licences with the Cloud Runtime Security add-on, the agent is also used to stop attacks running on workloads, including VMs, containers, Kubernetes, and serverless functions.

Consider the following:

✓ Determine the necessary bandwidth required to support the number of agents you plan to deploy.

✓ Verify endpoint operating systems and identify third-party security products to ensure they are compatible with Cortex XSIAM.

✓ Create a proof of concept (POC) that simulates your corporate production environment. After the successful completion of the initial POC, we recommend a phased rollout, which enables you to test the agent and its policies on a small scale before deploying them widely.

Consider the data sources to use

✓ Consider the data sources you want to initially ingest, such as Palo Alto Networks firewall/cloud logs, as they provide the most immediate security context and data for Cortex XSIAM's analytics.

In Cortex XSIAM, content is organized into content packs, which are either downloaded from the Data Sources catalog or from Marketplace. Start planning what content you require.

✓ Review the steps you need to take in your day-to-day SOC operations, and the required third-party tools/applications.

What are Cortex XSIAM data sources?

Consider roles and permissions

✓ Review and plan roles using Role-Based Access Control (RBAC) for your security operations team. Consider user groups and start with the default roles.

Set up users, groups, and roles