Managing Instances - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Cortex XSIAM
Creation date
Last date published
Administrator Guide

You can manage the Instances configured for a Data Source on the Data Sources page. You can edit, delete, enable, or disable instances, and refresh log data.

  1. Select SettingsData Sources.

  2. Find an instance by clicking on a Data Source name or using the Search field.

  3. In the row for the instance name, take the required action:



    Enable or disable an Instance

    Select or deselect the Enable checkbox.

    Refresh log data

    Click the Refresh icon.

    Edit an Instance

    1. Click the Edit icon.

    2. In Edit Data Source, you can update the values in the Connect and Collect sections. The options under Recommended Content are view only.

    3. Test the configuration.

    4. Connect the updated Instance.

    Delete an Instance

    Click the Delete icon.

    If you delete all the instances for a Data Source, the Data Source is not listed on the Data Sources page.