Configure server settings - Administrator Guide - Cortex XSIAM - Cortex

Configure server settings - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-09-12

Note

Keyboard shortcuts, timezone, and timestamp format are not set universally and only apply to the user who sets them.

Server Setting	Description
Keyboard Shortcuts	Enables you to change the default shortcut settings. The shortcut value must be a keyboard letter, A through Z, and cannot be the same for both shortcuts.
Timezone	Select a specific timezone. The timezone affects the timestamps displayed in Cortex XSIAM, auditing logs, and when exporting files.
Timestamp Format	The format in which to display Cortex XSIAM data. The format affects the timestamps displayed in Cortex XSIAM, auditing logs, and when exporting files. This setting is configured per user and not per tenant.
Email Contacts	A list of email addresses Cortex XSIAM can use as distribution lists. The defined email addresses are used to send product maintenance, updates, and new version notifications. These addresses are in addition to email addresses registered with your Customer Support Portal account.
Password Protection (for downloaded files)	Enable password protection when downloading retrieved files from an endpoint. This prevents users from opening potentially malicious files. Administrator permissions required. Note If the Password Protection (for downloaded files) setting under Settings → Configuration → General → Server Settings is enabled, enter the password 'suspicious' to download the file.
Google Maps Key	Enter the Google Maps API key to display the physical location of an entity on a Google map.
Scoped Server Access	Enforces access restrictions on users with an assigned scope. A user can inherit scope permissions from a group, or have a scope assigned directly on top of the role assigned from the group. If enabled, you must select the SBAC Mode, which is defined per tenant: Permissive: Enables users with at least one scope tag to access the relevant entity with that same tag. Restrictive: Users must have all the scoped tags that are tagged within the relevant entity of the system.
Data Ingestion Monitoring (Beta)	Data ingestion health monitors the availability and overall health of data collection. When enabled, Cortex XSIAM creates the following types of alerts: Ingestion health alerts: Based on the data ingestion metrics and indicate disruptions in data collection Collection health alerts: Based on error statuses in collection integrations and indicate that a collector is not connected If you disable data ingestion monitoring, Cortex XSIAM continues to collect metrics, but alerts are not created. Related information Use data ingestion health metrics in Cortex Query Language queries, and to create correlation rules with your own data ingestion logic. For more information, see Monitor data ingestion health. View all health alerts on the Health Alerts page. For more information, see About health alerts.
XQL Configuration	Enables setting case sensitivity across Cortex XSIAM. By default, this setting is set to `false` and field values are evaluated as case insensitive. This setting overwrites any other default configuration except for BIOCs, which will remain case insensitive no matter what this configuration is set to.
Define the incidents target MTTR per incident severity	Determines within how many days and hours you want incidents resolved according to the incident severity Critical, High, Medium, and Low. The defined MTTR is used to display the Resolved Incident MTTR dashboard widgets.
Impersonation Role	The type of role permissions granted to the Palo Alto Networks Support team when opening support tickets. We recommend that role permissions are granted only for a specific time frame, and full administrative permissions are granted only when specifically requested by the Support team. Role permissions include: Read-only: Default setting; grants read-only access to your tenant. Support-related actions: Grants permissions to tech support file collection, dump file collection, investigation query, correlation rule, BIOC and IOC rule editing, alert starring, exclusion, and exception editing Full role permissions: No limitations are applied; grants full permissions to all actions and content on your tenant Permission Reset Timeframe: Determines how long role permissions are valid.
Prisma Cloud Compute Tenant Pairing	Notice Requires a Cortex XSIAM or Cortex XDR Pro license To enable the capabilities of the Cloud Security Agent, the Prisma Cloud Compute tenant must be paired with an existing Cortex XSIAM tenant. Pairing is one-to-one, with the two tenants being in the same region. For more information, see Pairing Prisma Cloud with Cortex XSIAM .
Custom Content	Export all custom content: Exports custom content, such as playbooks and scripts as a content bundle, which you can import to another Cortex XSIAM tenant. Upload custom content: Imports custom content created from another Cortex XSIAM tenant.
Alerts	Create timer fields that display in the alerts table and alert layouts. For more information, see Configure timer fields.