Cortex XSIAM
Cortex XSIAM is Palo Alto Networks' AI-driven security operations platform that consolidates SIEM, SOAR, ASM, UEBA, and XDR into a single console. The exam tests the data pipeline, the detection layers, and how detections become incidents - not marketing names.
Ingestion and normalization
- Collectors include Broker VM for logs, Cortex XDR agents for endpoints, cloud feeds, and third-party integrations.
- Parsing rules turn raw logs into structured fields; modeling rules map those fields into the XSIAM Data Model (XDM). Unmapped fields are invisible to detections and XQL.
- Data lands in the Cortex Data Lake; ingestion is licensed by daily volume.
Detection layers
- Correlation rules are deterministic, rule-based detections.
- Analytics use AI/ML to surface anomalous behavior and create issues.
- Attack Surface Rules add exposure findings from ASM.
- Issues are promoted or grouped into incidents; playbooks automate triage and response.
Worked example
A newly connected firewall produces logs but no alerts. Reason in pipeline order: confirm the Broker VM is receiving data and the source shows connected; verify the parsing rule extracts fields; then check the modeling rule maps source_ip to xdm.source.ipv4. A correlation rule that references xdm.source.ipv4 cannot fire while the field is unmapped. Fix modeling first, then retest the rule.
Traps
- Calling XSIAM only a SIEM plus XDR; it also carries ASM, UEBA, and SOAR.
- Editing a detection rule when the actual fault is missing XDM mapping.
- Confusing issues (detections) with incidents (investigations).
- Assuming agentless or third-party logs skip parsing and modeling.