Install content packs from the Marketplace.
You can only install one content pack at a time. Cortex XSIAM adds automatically any content that is required to install the content pack. You can also add any recommended content packs, which use the content pack you want to install.
If you want to install data sources you can do one the following:
Go to the Data Sources page and add a data source by configuring an integration in the Data Sources page. Once configured, it automatically installs the required content packs, and recommends additional beneficial content such as playbooks and dashboards that are relevant for this specific data source. For details, see Adding a new data source or instance.
In Marketplace, select either Data Onboarder (which takes you to the integration configuration in the Data Sources page (for details, see Adding a new data source or instance)) or install the content pack directly from Marketplace. If installing the content pack from Marketplace, you will then have to configure the integration in the Automation & Feed Integrations page.
Note
Currently, not all content packs are supported in the Data Sources page. For example, content packs with several integrations are not yet supported.
Go to → and locate the content pack you want to install.
Click the required content pack and review the contents.
Click Install to add the content pack to the Cart.
You can view details of the content packs by clicking the content you want to install.
(Optional) If the content pack includes optional content, select the content you want to add.
The Cart displays the number of items you are installing including any required packs. You can log in and out, but the content remains in the Cart until you click either Empty cart or Install.
Click Install.
If you receive an error message, you need to fix the error before installing. In case of a warning message, you can install and fix it later. For more information, see errors and warning messages.
After installation, go to the relevant tab to view/edit the content.