Cortex XSOAR provides security orchestration, incident management, and interactive investigation. Overview of Cortex XSOAR features and concepts.
Cortex XSOAR combines security orchestration, incident management, and interactive investigation into a seamless experience. The orchestration engine is designed to automate security product tasks and weave in human analyst tasks and workflows. Cortex XSOAR is powered by DBot, which learns from real life analyst interactions and past investigations to help SOC teams with analyst assignment suggestions, playbook enhancements, and best next steps for investigations. With Cortex XSOAR, security teams can build future proof security operations to reduce MTTR, create consistent and audited incident management process, and increase analyst productivity.
This guide is split into the following sections:
Understand Cortex XSOAR concepts, learn how to use the search, markdown, work with APIs, see how the CLI works.
Get up and running in Cortex XSOAR, including installation, High Availability, disaster recovery, remote repositories, engines, user and role management.
After you have set up Cortex XSOAR, you can start to configure and customize dataindicators, incidents, playbooks, dashboards. For example, customize out-of-the-box playbooks or build your own to match the workflows and integrations relevant for your organization
This section deals with the common daily tasks in Cortex XSOAR, such as managing incidents, extracting and enriching indicators, and investigating and remediating security threats.
View the server configurations, telemetry, management of audit logs, performance tuning, and keyboard shortcuts. Use this section as an easy way of finding information quickly.