Configure a Mail Sender Integration - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Learn more about configuring a mail integration to enable the server to send emails for system notifications and playbooks.

A mail integration enables the server to send emails and can be used for system notifications and playbooks. When you use the mail integration for playbook tasks, you can pass arguments, such as to, subject, and body, to customize the contents of your email.

Cortex XSIAM provides a built-in mail sender integration. It is installed out-of-the-box and does not require you to set up an SMTP server or provide any credentials. Emails sent via the built-in mail sender integration have a watermark that specifies the FQDN and mentions that the mail was sent via Cortex XSIAM. This provides protection against possible abuse of the built-in mail sender.

However, if you want to use a different email sender, you can configure one during your initial setup.

  1. Go to Marketplace.

  2. Search for and download a mail sender content pack (such as EWS).

  3. Configure the mail sender integration (for example, EWS O365). When configuring your mail sender integration, select Enable to enable your mail sender integration and deselect the Enable option for the built-in mail sender.