Palo Alto Cortex XSIAM

This skill covers Palo Alto Cortex XSIAM, the AI-driven SOC platform that converges SIEM, SOAR, XDR, and ASM into a single platform. It has deep knowledge of:

• XQL (XSIAM Query Language) for investigation and detection
• AI-driven correlation and ML-based event clustering
• Automation Center (integrated SOAR with XSOAR heritage)
• Investigation Graph for visual threat analysis
• Data integration broker (log collection, normalization, transformation)
• XDM (XSIAM Data Model) normalization
• XSIAM Copilot (AI assistant)
• Analytics rules and BIOC (Behavioral IOC) rules
• Alert grouping and incident management
• Attack Surface Management integration

Platform context: XSIAM represents Palo Alto's vision of an AI-first SOC platform. It absorbed QRadar SaaS customers and aims to replace traditional SIEM+SOAR stacks with a unified, ML-driven platform.

How to Approach Tasks

1. Classify the request:

   • Investigation -- XQL query development, Investigation Graph usage
   • Detection engineering -- Analytics rules, BIOC rules, correlation logic
   • Automation -- Automation Center playbooks, response actions
   • Data onboarding -- Data integration broker, XDM mapping, parser configuration
   • Architecture -- Platform capabilities, integration strategy, migration planning
   • XSOAR-specific -- Read the xsoar skill for standalone XSOAR

2. Gather context -- Existing Palo Alto products (Cortex XDR, XSOAR, PAN-OS), current SIEM, migration timeline

3. Analyze -- Consider the converged platform advantages (native XDR integration) and vendor lock-in trade-offs

4. Recommend actionable guidance with XQL examples

Core Expertise

XQL (XSIAM Query Language)

XQL is the query language for XSIAM, designed for security investigation:

// Basic: Failed authentication attempts
dataset = xdr_data
| filter event_type = ENUM.LOGIN and event_sub_type = ENUM.LOGIN_FAIL
| comp count(action_remote_ip) as fail_count by action_remote_ip, auth_domain_username
| filter fail_count > 20
| sort desc fail_count
| limit 50

XQL key commands:

Command	Purpose	Example
dataset	Select data source	dataset = xdr_data
filter	Filter events	filter process_name = "powershell.exe"
comp	Aggregate (compute)	comp count(src_ip) as total by dest_ip
alter	Add/modify fields	alter risk = if(count > 100, "high", "low")
sort	Order results	sort desc total_bytes
limit	Restrict output	limit 100
dedup	Deduplicate	dedup src_ip, dest_ip by asc _time
join	Combine datasets	join type=inner (subquery) as t1
union	Merge datasets	union dataset = panw_traffic
bin	Time bucketing	bin _time span = 1h
fields	Select columns	fields src_ip, dest_ip, action
config	Set query parameters	config timeframe = 24h

Advanced XQL patterns:

// Detect lateral movement: same user authenticating to multiple hosts
config timeframe = 1h
| dataset = xdr_data
| filter event_type = ENUM.LOGIN and event_sub_type = ENUM.LOGIN_SUCCESS
| comp count_distinct(agent_hostname) as unique_hosts,
      array_agg(agent_hostname) as host_list
      by auth_domain_username
| filter unique_hosts > 5
| sort desc unique_hosts

// Investigate process execution chain
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter agent_hostname = "WORKSTATION-01"
| fields _time, actor_process_image_path, actor_process_command_line,
         causality_actor_process_image_path, os_actor_process_image_path
| sort asc _time

AI-Driven Correlation

XSIAM uses ML models to correlate and cluster alerts:

• Smart Alert Grouping -- ML clusters related alerts into incidents based on entity relationships, timing, and attack patterns (not just simple field matching)
• Analytics-First Approach -- ML models process raw telemetry to identify threats before rule-based detection
• Causality Chain -- Tracks the full attack chain from initial access through lateral movement to impact
• Risk Scoring -- Entity-based risk scores calculated from multiple signal types

How XSIAM correlation differs from traditional SIEM:

Traditional SIEM	XSIAM
Rule-based correlation only	ML correlation + rule-based
Manual alert-to-incident mapping	Automatic smart grouping
Alert per rule match	Incident per attack chain
Static thresholds	Adaptive ML thresholds
Manual entity correlation	Automatic causality analysis

Automation Center

The Automation Center is XSIAM's integrated SOAR (built on XSOAR technology):

• Playbooks -- Visual workflows for automated response (XSOAR playbook format)
• Integrations -- 900+ integrations from XSOAR marketplace
• Sub-playbooks -- Reusable automation modules
• Scripts -- Python/PowerShell scripts for custom logic
• War Rooms -- Collaborative investigation spaces

Key differences from standalone XSOAR:

• Native integration with XSIAM alerts and incidents
• Access to XQL within playbooks
• Direct access to XDR response actions (isolate, quarantine, block)
• Unified incident queue (no separate SOAR incident view)

Analytics and BIOC Rules

Analytics rules -- Traditional correlation rules:

Rule: Multiple Failed Logins Followed by Success
Trigger: When a source IP has > 10 failed logins followed by
         a successful login within 5 minutes
Action: Create alert, severity HIGH
MITRE: T1110 (Brute Force)

BIOC (Behavioral IOC) rules -- Behavioral detection on endpoint telemetry:

Rule: Suspicious Process Injection
Trigger: When a process writes to another process's memory
         AND the target process is a system process
         AND the source process is not a known security tool
Action: Create alert, severity CRITICAL
MITRE: T1055 (Process Injection)

Rule types:

Type	Data Source	Detection Method
Analytics	Any ingested data	XQL-based correlation
BIOC	Cortex XDR agent telemetry	Behavioral pattern matching on endpoints
IOC	Threat intelligence feeds	Indicator matching (IPs, hashes, domains)
ML	All telemetry	Machine learning anomaly detection

Investigation Graph

Visual investigation tool for exploring attack chains:

• Automatic graph generation -- Creates visual graph from incident entities
• Entity nodes -- Users, hosts, IPs, processes, files, domains
• Relationship edges -- Authentication, network connections, process execution, file operations
• Timeline integration -- Overlay events on timeline for temporal analysis
• Pivoting -- Click on any entity to explore its relationships and activity
• XQL integration -- Drill into XQL queries from any graph node

Data Integration Broker

XSIAM's data collection and normalization layer:

Ingestion methods:

Method	Use Case
Cortex XDR agent	Endpoint telemetry (native, richest data)
Syslog/CEF	Network devices, firewalls, legacy systems
API collectors	Cloud services, SaaS platforms
Cloud connectors	AWS, Azure, GCP native integration
Broker VM	On-premises data collection proxy
HTTP Event Collector	Application and container logs

XDM (XSIAM Data Model) normalization:

• Normalizes all ingested data to a common schema
• Similar in concept to ECS, CIM, ASIM
• Enables cross-source correlation without source-specific queries
• Custom parsers for unsupported log formats

XSIAM Copilot

AI-powered assistant for SOC operations:

• Natural language investigation -- "What happened on WORKSTATION-01 in the last 24 hours?"
• XQL generation -- Converts natural language to XQL queries
• Incident summary -- AI-generated narrative of incident timeline and impact
• Response recommendation -- Suggests containment and remediation actions
• Playbook assistance -- Helps build and debug automation playbooks

Common Pitfalls

1. Vendor lock-in -- XSIAM is deeply integrated with Palo Alto's ecosystem. Migrating away is significantly harder than with open-standard SIEMs.
2. Pricing complexity -- Consumption-based pricing can be unpredictable. Monitor data ingestion and compute usage carefully.
3. XDR agent dependency -- The richest detection capabilities require Cortex XDR agents on endpoints. Without agents, XSIAM operates primarily as a log analytics platform.
4. ML trust calibration -- ML-based correlation may group unrelated alerts or miss correlated ones. Monitor smart grouping accuracy and provide feedback.
5. Automation Center learning curve -- While XSOAR-based, the Automation Center in XSIAM has some differences from standalone XSOAR. Existing XSOAR playbooks may need adaptation.
6. Custom parser complexity -- Building custom parsers for non-standard log sources requires understanding XDM and the parsing framework.
7. Migration effort -- Migrating from traditional SIEM to XSIAM requires rethinking detection strategy (rule-based to analytics-first).

Migration Considerations

From QRadar SaaS

IBM divested QRadar SaaS to Palo Alto. Migration path:

1. Data migration handled by Palo Alto migration tooling
2. AQL rules need conversion to XQL analytics rules
3. QRadar offenses map to XSIAM incidents
4. Reference sets map to XSIAM threat intelligence or lookup tables
5. QRadar SOAR playbooks need rebuilding in Automation Center

From Other SIEMs

1. Detection rules -- Convert SIGMA rules to XSIAM analytics rules
2. Data onboarding -- Configure Data Integration Broker for each log source
3. Automation -- Rebuild SOAR playbooks in Automation Center (XSOAR-compatible)
4. Custom content -- Recreate dashboards, reports, and custom searches in XQL
5. Parallel run -- Operate both SIEMs for 30-60 days to validate detection parity