XSIAM Analyst key terms

A predefined, reusable sequence of automated tasks and decision points that Cortex XSIAM runs in response to an alert or incident, replacing manual analyst steps with consistent, repeatable logic.

A single unit of work inside a playbook, such as running a command, querying a system, sending a notification, or asking for human input. Tasks can run in sequence or in parallel.

The rule that decides when a playbook starts, for example on a new incident, a specific alert name, a severity threshold, or a scheduled time. Multiple triggers can start the same playbook.

A playbook task that evaluates a condition and routes execution down different branches, letting one playbook handle several scenarios without duplicating the whole workflow.

A playbook step that pauses automation and waits for an analyst to act, such as approving a containment action, answering a question, or supplying data before the workflow continues.

A named value passed into a playbook at start time, such as an IP address, endpoint identifier, or incident field, which tasks reference instead of hard-coded values.

Engine-level rules that match incoming alerts or incidents by field values and then apply actions automatically, such as changing severity, assigning an owner, or launching a playbook.

A configured connection to an external product, such as an endpoint agent, firewall, identity provider, or ticketing system, holding the server address and credentials that commands use.

An individual action exposed by an integration, for example isolating an endpoint, blocking a hash, or enriching an IP address. Playbook tasks and the CLI invoke commands.

The structured result a command returns, stored as context data with named fields. Later tasks read these fields to make decisions or build further actions.

The structured, hierarchical data store that holds investigation results, command outputs, and incident fields during a playbook run, referenced by path expressions in later tasks.

The command-line interface in Cortex XSIAM where analysts run integration commands directly, test arguments, inspect context output, and troubleshoot playbook logic outside of a workflow.

A scheduled or on-demand execution of a playbook or script that runs without a triggering incident, commonly used for recurring enrichment, cleanup, or reporting tasks.

Custom automation code, typically Python or JavaScript, that runs inside the platform to transform data, parse results, or perform logic that built-in commands do not cover.

A rule that suppresses matching alerts so they do not create incidents, used to filter known-benign activity. Exclusions should be narrow and reviewed to avoid hiding real threats.

The human decision point in an automated workflow where an analyst confirms or rejects a proposed action, such as containment, before the playbook proceeds.

A connected telemetry feed, such as endpoint, network, identity, cloud audit, or email logs, that Cortex XSIAM ingests and normalizes for detection and investigation.

The process of mapping raw vendor log fields into a common schema so events from different products can be correlated, searched, and used by the same detection rules.

The extended data model, a normalized schema of standard fields and event categories that all ingested telemetry is mapped into, enabling cross-source queries and detections.

The query language used to search normalized and raw datasets in Cortex XSIAM, supporting filtering, aggregation, joins, and time-based analysis for hunting and rule logic.

A named, queryable collection of events or records in the platform, such as endpoint process events or authentication logs, that XQL queries read from.

Logic that evaluates ingested telemetry against defined conditions and raises an alert when the pattern matches, forming the core building block of threat detection.

A detection that combines multiple events or alerts across sources and time windows to surface a higher-confidence scenario that no single event would reveal alone.

Detection based on statistical models and machine learning that flag deviations from normal behavior, such as unusual process activity or atypical authentication patterns, rather than fixed signatures.

The component of Cortex XSIAM that runs detection content, correlation, and machine-learning models over ingested data and produces alerts for triage.

A signal raised by a detection rule or analytics model indicating suspicious activity. Alerts are triaged, grouped, and may be promoted into incidents for response.

A consolidated case that groups related alerts and evidence for investigation and response, carrying severity, owner, status, and a timeline of activity.

A classification assigned to an incident, such as malware, phishing, or insider threat, that drives which playbook runs and which fields or views apply.

An observable artifact such as an IP address, domain, file hash, or user account that carries a verdict from threat intelligence and can be searched or blocked.

The reputation assigned to an indicator, typically benign, unknown, suspicious, or malicious, which analysts and playbooks use to prioritize or escalate an investigation.

External and internal knowledge about known malicious actors, infrastructure, and artifacts that is matched against telemetry to enrich alerts and guide response decisions.

A numeric value that ranks incidents or assets by combined severity, confidence, asset criticality, and threat context, helping analysts prioritize the highest-impact work first.

An alert that fires on legitimate activity rather than real malicious behavior. Reducing false positives through tuning is a core detection-engineering task.

The iterative adjustment of detection rules, exclusions, and thresholds to lower noise while preserving true detections, usually driven by analyst feedback on triaged alerts.

Proactive, hypothesis-driven search through telemetry using queries and analytics to find threats that existing detections missed, often before any alert is raised.

A containment action that cuts an endpoint off from the network while keeping the agent connected for investigation, preventing lateral movement or data exfiltration.

The phase of response that limits the spread of a threat, using actions such as isolating endpoints, blocking indicators, disabling accounts, or quarantining files.

The response phase that removes the threat from the environment, for example deleting malware, killing malicious processes, or rebuilding compromised systems after containment.

Any concrete step taken against a threat, such as blocking a hash, isolating a host, disabling a user, or quarantining email, usually executed manually or through a playbook.

The workflow for tracking incidents through statuses, assignments, notes, and collaboration so that response progress and evidence are documented and auditable.

A shared workspace attached to an incident where analysts discuss findings, run commands, view the timeline, and coordinate response actions in one place.

The process of adding context to an alert or indicator, such as reputation, geolocation, asset owner, or prior sightings, so analysts can judge severity and decide on response.