Onboarding data sources - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Explains how to onboard data sources and instances from the Data Source page.

On this page you can see all data sources with configured instances, grouped by integration. Data sources are categorized into PALO ALTO NETWORKS INTEGRATIONS and 3RD PARTY INTEGRATIONS.

Click on a data source name to see information about its configured instances and their status. You can filter the list of data sources, or search by integration, content pack, or instance name. You can also onboard new data sources and instances.

Access the Data Source page from SettingsData Sources or SettingsConfigurationsData CollectionData Sources.

From this page you can:

  • + Add Data Source with the Data Source Onboarder.

    The Onboarder provides a simplified integration setup page that automatically installs the required Marketplace packs and recommends additional content, such as playbooks and dashboards, that are relevant to the selected data source.

  • + Add New Instance for an integrated data source.

  • Review and take actions on existing instances.

    You can refresh log data, edit, delete, enable, or disable the instance.

  • Globally turn on or off URL and File log types collection for Palo Alto Networks integrations.

For more information, see the following topics: