Palo Alto SecOps Professional cheat sheet

Cortex XSOAR and Cortex XSIAM are distinct products: XSOAR is a SOAR platform (playbooks, integrations, incident war rooms); XSIAM is an AI-driven SOC platform that consolidates SIEM, SOAR, ASM, and XDR data on one data model.

Cortex Data Lake (CDL) is the cloud logging backend for PAN-OS and Prisma Access telemetry; XDR and XSIAM consume it, and query syntax follows the PAN-OS Log Query Language (LQL).

Cortex XDR agents run on endpoints and report to the Cortex management service; agent communication uses TLS on port 443 outbound to the regional Cortex service address.

RBAC in Cortex products is role-based with predefined roles (e.g., Account Admin, Instance Admin, Analyst, Viewer) plus scoped roles; a role binds a permission set to a resource scope.

Cortex XSOAR server components: application server, PostgreSQL database, Elasticsearch index, and a message broker; playbook workers execute integration commands.

Content packs are versioned bundles containing playbooks, integrations, scripts, layouts, and classifiers; installation is per-tenant and version-pinned.

XSIAM ingests data through brokers (on-premises collection points) and direct cloud feeds; brokers buffer and forward events when the cloud is unreachable.

Audit logs record user and API actions; they are the authoritative source for who changed a playbook, integration instance, or exclusion.

API access uses an API key tied to a user or a non-interactive service account; keys inherit the permission scope of that identity.

Onboarding order: validate source connectivity, normalize to the platform schema, verify parsing with sample events, confirm event volume/cost, then enable detections that depend on the dataset.

XSIAM data sources are defined by dataset and vendor/product; a dataset is queryable only after its parsing rules map raw fields to the normalized schema (XDM-style fields).

Broker configuration requires a broker group, a broker vCPU/memory sizing tier, and a certificate; brokers must be able to reach the Cortex cloud endpoint over 443.

Log Stitching correlates raw logs with endpoint telemetry by common fields (IP, hostname, user, hash); it depends on consistent field normalization, not on identical source formats.

Collection integrations in XSOAR use fetch queries and a lookback window; overlapping fetch intervals cause duplicate incidents, so incidents are deduplicated by a unique ID field.

Custom parsers are tested against representative raw events including error and edge-case formats (empty fields, multi-value fields, non-UTC timestamps).

Detection rules should be tuned with exclusion lists scoped narrowly (by user, host, or field value) rather than disabling the whole rule.

Ingestion cost and license consumption scale with events per second and data retention; sampling or filtering at the broker reduces volume before it reaches the cloud.

Severity in XSOAR incidents is set by playbook logic or by the incident type's mapping; SLA timers start at incident creation and pause/resume based on configured fields.

Incident war room holds entries, tasks, and evidence; the context data object is the shared state that playbooks read and write via ${incident.field} and ${.} syntax.

Indicator extraction uses regex-based extractors defined per incident type; extracted indicators are enriched and can be tagged malicious/benign to drive verdicts.

Causality chain and process tree in Cortex XDR show parent-child process relationships; the initiating process is the root of the tree, not the alerting process.

Alert-to-incident grouping in XSIAM uses alert grouping rules; a single incident may contain many alerts that share entities (host, user, hash).

Investigation queries should pivot on entities: from an alert, extract IP, domain, hash, user, and host, then query each against telemetry and threat intel.

Verdicts (malicious, suspicious, benign) propagate to indicators; closing an incident with a false-positive classification feeds tuning data for detections.

Timeline analysis orders events by normalized timestamp; clock skew between sources produces misleading ordering, so verify source time zones.

Playbooks are DAGs of tasks; each task is a script, integration command, manual task, or sub-playbook, and conditional tasks branch on context values.

Context paths use dot notation with array indexing: ${incident.accounts.[0].DisplayName}; the built-in ${.} object refers to the current task output.

Playbook inputs/outputs declare the contract with parent playbooks; outputs must be set explicitly or the parent cannot read results.

Built-in automation scripts include Set, SetAndHandleEmpty, DeleteContext, and transformers such as the 'Get' transformers that filter nested data.

Integration instances hold credentials and server URLs; commands require an enabled instance and a matching command name (brand.command).

Error handling uses task-level 'continue on error' and playbook-level error handlers; unhandled errors stop the branch and mark the task failed.

Loops over lists are implemented with sub-playbooks invoked per item, or with built-in scripts that iterate context arrays.

Playbook debugging uses the playbook debugger, which runs tasks against a selected incident and lets you set context values before execution.

Tests and versioning: playbook changes are saved as versions; production automation should be validated in a non-production tenant or with a test incident.

Indicator types (IP, domain, URL, file hash, CVE) drive enrichment commands; each type maps to integration commands such as !ip, !domain, !file.

Indicator scoring in XSOAR combines source reliability and indicator confidence; a high-reliability source with low confidence yields a moderate score.

Threat intel feeds are ingested as indicators with expiration (TTL); expired indicators are removed from the indicator store and stop matching.

Hunting hypotheses are stated as testable questions (e.g., 'Did any host run a signed binary from a temp path?'), then expressed as a query over telemetry.

XQL (XSIAM) and LQL (CDL) support filtering, aggregation (comp count() by), and time-bounded queries; results can be saved as scheduled queries to create alerts.

MITRE ATT&CK mapping links detections and hunts to tactics/techniques; coverage gaps appear where no analytic maps to a technique.

IOC sweeps should pivot on both indicators and behaviors: a hash match confirms, while a behavior (e.g., LSASS access) catches variants.

Retro-hunting re-runs a new detection against historical data to find past compromises; it requires retained telemetry covering the hunt window.

Cortex XSOAR and Cortex XSIAM are distinct products: XSOAR is a SOAR platform (playbooks, integrations, incident war rooms); XSIAM is an AI-driven SOC platform that consolidates SIEM, SOAR, ASM, and XDR data on one data model.

Cortex Data Lake (CDL) is the cloud logging backend for PAN-OS and Prisma Access telemetry; XDR and XSIAM consume it, and query syntax follows the PAN-OS Log Query Language (LQL).

Cortex XDR agents run on endpoints and report to the Cortex management service; agent communication uses TLS on port 443 outbound to the regional Cortex service address.

RBAC in Cortex products is role-based with predefined roles (e.g., Account Admin, Instance Admin, Analyst, Viewer) plus scoped roles; a role binds a permission set to a resource scope.

Cortex XSOAR server components: application server, PostgreSQL database, Elasticsearch index, and a message broker; playbook workers execute integration commands.

Content packs are versioned bundles containing playbooks, integrations, scripts, layouts, and classifiers; installation is per-tenant and version-pinned.

XSIAM ingests data through brokers (on-premises collection points) and direct cloud feeds; brokers buffer and forward events when the cloud is unreachable.

Audit logs record user and API actions; they are the authoritative source for who changed a playbook, integration instance, or exclusion.

API access uses an API key tied to a user or a non-interactive service account; keys inherit the permission scope of that identity.

Onboarding order: validate source connectivity, normalize to the platform schema, verify parsing with sample events, confirm event volume/cost, then enable detections that depend on the dataset.

XSIAM data sources are defined by dataset and vendor/product; a dataset is queryable only after its parsing rules map raw fields to the normalized schema (XDM-style fields).

Broker configuration requires a broker group, a broker vCPU/memory sizing tier, and a certificate; brokers must be able to reach the Cortex cloud endpoint over 443.

Log Stitching correlates raw logs with endpoint telemetry by common fields (IP, hostname, user, hash); it depends on consistent field normalization, not on identical source formats.

Collection integrations in XSOAR use fetch queries and a lookback window; overlapping fetch intervals cause duplicate incidents, so incidents are deduplicated by a unique ID field.

Custom parsers are tested against representative raw events including error and edge-case formats (empty fields, multi-value fields, non-UTC timestamps).

Detection rules should be tuned with exclusion lists scoped narrowly (by user, host, or field value) rather than disabling the whole rule.

Ingestion cost and license consumption scale with events per second and data retention; sampling or filtering at the broker reduces volume before it reaches the cloud.

Severity in XSOAR incidents is set by playbook logic or by the incident type's mapping; SLA timers start at incident creation and pause/resume based on configured fields.

Incident war room holds entries, tasks, and evidence; the context data object is the shared state that playbooks read and write via ${incident.field} and ${.} syntax.

Indicator extraction uses regex-based extractors defined per incident type; extracted indicators are enriched and can be tagged malicious/benign to drive verdicts.

Causality chain and process tree in Cortex XDR show parent-child process relationships; the initiating process is the root of the tree, not the alerting process.

Alert-to-incident grouping in XSIAM uses alert grouping rules; a single incident may contain many alerts that share entities (host, user, hash).

Investigation queries should pivot on entities: from an alert, extract IP, domain, hash, user, and host, then query each against telemetry and threat intel.

Verdicts (malicious, suspicious, benign) propagate to indicators; closing an incident with a false-positive classification feeds tuning data for detections.

Timeline analysis orders events by normalized timestamp; clock skew between sources produces misleading ordering, so verify source time zones.

Playbooks are DAGs of tasks; each task is a script, integration command, manual task, or sub-playbook, and conditional tasks branch on context values.

Context paths use dot notation with array indexing: ${incident.accounts.[0].DisplayName}; the built-in ${.} object refers to the current task output.

Playbook inputs/outputs declare the contract with parent playbooks; outputs must be set explicitly or the parent cannot read results.

Built-in automation scripts include Set, SetAndHandleEmpty, DeleteContext, and transformers such as the 'Get' transformers that filter nested data.

Integration instances hold credentials and server URLs; commands require an enabled instance and a matching command name (brand.command).

Error handling uses task-level 'continue on error' and playbook-level error handlers; unhandled errors stop the branch and mark the task failed.

Loops over lists are implemented with sub-playbooks invoked per item, or with built-in scripts that iterate context arrays.

Playbook debugging uses the playbook debugger, which runs tasks against a selected incident and lets you set context values before execution.

Tests and versioning: playbook changes are saved as versions; production automation should be validated in a non-production tenant or with a test incident.

Indicator types (IP, domain, URL, file hash, CVE) drive enrichment commands; each type maps to integration commands such as !ip, !domain, !file.

Indicator scoring in XSOAR combines source reliability and indicator confidence; a high-reliability source with low confidence yields a moderate score.

Threat intel feeds are ingested as indicators with expiration (TTL); expired indicators are removed from the indicator store and stop matching.

Hunting hypotheses are stated as testable questions (e.g., 'Did any host run a signed binary from a temp path?'), then expressed as a query over telemetry.

XQL (XSIAM) and LQL (CDL) support filtering, aggregation (comp count() by), and time-bounded queries; results can be saved as scheduled queries to create alerts.

MITRE ATT&CK mapping links detections and hunts to tactics/techniques; coverage gaps appear where no analytic maps to a technique.

IOC sweeps should pivot on both indicators and behaviors: a hash match confirms, while a behavior (e.g., LSASS access) catches variants.

Retro-hunting re-runs a new detection against historical data to find past compromises; it requires retained telemetry covering the hunt window.

Severity in XSOAR incidents is set by playbook logic or by the incident type's mapping; SLA timers start at incident creation and pause/resume based on configured fields.

Incident war room holds entries, tasks, and evidence; the context data object is the shared state that playbooks read and write via ${incident.field} and ${.} syntax.

Indicator extraction uses regex-based extractors defined per incident type; extracted indicators are enriched and can be tagged malicious/benign to drive verdicts.

Causality chain and process tree in Cortex XDR show parent-child process relationships; the initiating process is the root of the tree, not the alerting process.

Alert-to-incident grouping in XSIAM uses alert grouping rules; a single incident may contain many alerts that share entities (host, user, hash).

Investigation queries should pivot on entities: from an alert, extract IP, domain, hash, user, and host, then query each against telemetry and threat intel.

Verdicts (malicious, suspicious, benign) propagate to indicators; closing an incident with a false-positive classification feeds tuning data for detections.

Timeline analysis orders events by normalized timestamp; clock skew between sources produces misleading ordering, so verify source time zones.