Cortex XSIAM
This domain covers Cortex XSIAM as the consolidated, AI-driven SOC platform: how data gets in, how it is normalized, how detections and incident grouping work, and how automation and exposure management fit together.
Core rules and concepts
- XSIAM consolidates SIEM, SOAR, ASM, UEBA and endpoint telemetry in one platform; it is not merely XDR renamed, and it does not make XSOAR disappear overnight.
- Onboarding paths: Broker VMs for on-premises collection, cloud connectors for SaaS sources, and Marketplace content packs that ship parsers and modeling rules per source.
- Normalization to XDM is the hinge. Parsing rules extract raw fields; modeling rules map them into the schema. A source can ingest successfully and still be useless because key fields are unmapped.
- Detection layers: correlation rules (deterministic), BIOCs (behavioral analytics), threat-intelligence matching, and analytics-driven anomaly detection.
- Incident grouping and scoring merge related alerts through causality and prioritize by score; automation playbooks fire on incident creation.
Worked example
Impossible-travel detections never fire after firewall logs are onboarded. Work the ladder in order: (1) is data arriving - check source health; (2) are username, source IP and timestamp mapped to XDM - check modeling rules; (3) does the rule reference the mapped field names; (4) is an identity source onboarded to establish a baseline location? Fix data before rules; editing the detection first usually hides the real defect.
Traps
- Onboarding a source and assuming detection coverage without validating XDM field mapping.
- Confusing correlation rules with BIOCs when asked which layer produced a given alert.
- Forgetting Broker VM sizing and high availability for on-premises sources.
- Assuming exposure-management findings and endpoint alerts share one workflow.