Post-deployment checklist - Use the post-deployment checklist after you have onboarded Cortex XSIAM. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Set up relevant integrations

✓ Install essential content packs (for example, common security use cases or SOAR playbook) and configure relevant integrations, from the Data Sources catalog.

If your use case is not in the Data Sources catalog, you can install content from Marketplace. For example, if you require content packs such as Phishing and Malware, you need to download the pack from Marketplace and configure the integration. The Data Sources catalog includes the most used data sources to help you onboard.

What are Cortex XSIAM data sources?

Update users and roles

✓ Review and configure users, roles, and user groups as required. Each role extends specific privileges to users. The way you configure administrative access depends on your organization's security requirements. Use roles to assign specific access privileges to administrative user accounts.

Manage user roles and access management

Dashboards

✓ Review and configure dashboards and ensure you can visualize activity from your active log sources (for example, VPN logins, Firewall blocks).

About dashboards

Server and security settings

✓ Customize and configure Cortex XSIAM for a more personalized user experience:

Log forwarding

✓ Set up sending logs to an external service, such as a Slack channel or an email distribution list.

Forward logs and data from Cortex XSIAM to external services

Customize endpoint security profiles and policies

✓ Review your policy rules and the security profiles assigned to these rules and make any necessary adjustments. After the pilot group has been running for about a week, analyze the cases and issues that were generated. You may find issues with benign activity, such as in-house applications or custom scripts. Do the following:

Set up endpoint profiles and exception rules

Expand the agent deployment

✓ Expand the Agent deployment to larger groups for initial data collection.

Define endpoint groups

✓ (Optional, can be performed post-deployment) Define an endpoint group to apply policy rules and manage specific endpoints.

Instead of managing security policies and configurations for each device, you can manage them for the entire group. For example, create a High-Security Prevention Profile and apply it to an entire group, Critical Financial Servers.

Define endpoint groups

Complete the XDR agent deployment

✓ Gradually distribute the Cortex XDR agent throughout the organization until all endpoints are protected. You can do this at any time during post-deployment.

Set up XDR Collectors for specific Windows/Linux logs (optional)

✓ Set up XDR Collectors (XDRCs), which are installed directly on a Windows or Linux machine to collect log files from that machine's local file system. They are crucial for ingesting detailed Windows and Linux event logs from systems where the full Cortex XDR Agent may not be deployed, or to collect specific log types, complementing agent data.

✓ After installing XDRCs, create/configure a profile and apply it to a policy. The XDRC then starts collecting and forwarding the logs to Cortex XSIAM.

XDR Collectors

Set up and configure Broker VM (optional but highly recommended)

✓ Set up the Broker VM, which functions as a secure on-prem gateway for Cortex XSIAM. It centralizes on-prem data collection by running applets to ingest logs from on-prem security devices and services that can’t send data directly to the cloud. It also allows secure agent proxy and communication located in restricted or air-gapped networks to communicate securely with the Cortex XSIAM tenant.

Set up and configure Broker VM

Set up and deploy an engine (optional)

✓ Deploy an engine if you have specific automation and feed integrations, scripts, or playbooks that execute actions or fetch data directly from resources within your internal network (for example, querying an on-prem Active Directory, isolating a machine via a local tool).

An engine is a proxy server application that is installed on a remote machine, enabling communication between the remote machine and the Cortex XSIAM tenant. You can run playbooks, scripts, commands, and integrations on the remote machine, and the results are returned to the tenant.

What is an engine?