Marketplace Overview - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Integrations

You can define the following types of integrations:

Playbooks

You can automate many security processes, including handling investigations and managing tickets and security responses that were previously handled manually. When an alert is ingested, the playbook runs and an alert is created.

Alert Types

All alerts that are ingested into Cortex XSIAM are assigned an alert type when they are classified. After you classify the alert, you can then map the relevant fields to the alert.

Alert Fields

Alert types contain fields that are relevant to the alert type.

Scripts

Perform specific actions and are comprised of commands, which are used in playbook tasks and when running commands in the alert War Room.

Correlation Rules

Analyzes correlation of multi-event from multiple sources by using the Cortex XSIAM XQL-based engine for creating these correlations (scheduled) rules. Alerts can then be triggered based on these rules with a defined time-frame and schedule.

Data Model Rules

Data Model rules enable you to normalize logs for out-of-the-box analytics and data enrichment. This allows you to do the following:

Some content packs contain out-of-the-box default Data Model Rules.

Parsing Rules

Enables you to add rules which remove non-required data for analytics, hunting, or regulation, reduce data storage costs, pre-process all incoming data, etc.

DashboardsDashboard

Dashboards consist of visualized data powered by fully customizable widgets, which enables you to analyze data from inside or outside Cortex XSIAM, in different formats such as line charts, tables, text, etc.

Reports

Reports contain statistical data in the form of widgets (from a dashboard), which enable you to analyze data from inside or outside Cortex XSIAM, in different formats such as line charts, tables, text from information, etc.