Cortex XSIAM SDK Tools FAQs

Question 1

Are there any risks associated with using these tools in a production environment?

Accepted Answer

Yes, some remote operations like `upload_content`, `run_command`, and `run_playbook` are production-impacting and can modify your XSIAM/XSOAR tenant. These should be used with extreme caution.

Question 2

What types of Cortex XSIAM/XSOAR content can I manage?

Accepted Answer

You can manage and develop various content types including playbooks, scripts, integrations, XQL rules, classifiers, and mappers. The tools help find examples and validate their structure.

Question 3

Is this tool officially supported by Palo Alto Networks?

Accepted Answer

No, Cortex XSIAM SDK Tools is a community project and is not officially supported by Palo Alto Networks. It leverages the official `demisto-sdk` but is an independent contribution.

Question 4

How do these tools help accelerate content development for XSIAM/XSOAR?

Accepted Answer

They accelerate development by offering natural language pattern search, allowing quick discovery of relevant content. They also automate tasks like content scaffolding, formatting, validation, linting, and provide remote operations for deployment and testing.

Question 5

What are the Cortex XSIAM SDK Tools?

Accepted Answer

The Cortex XSIAM SDK Tools empower LLM coding assistants to accelerate development of Cortex XSIAM/XSOAR content. They provide semantic search for existing content, SDK operations for scaffolding and validation, and remote tenant management.

Cortex XSIAM SDK Tools

Cortex XSIAM SDK Tools

Key Features

Use Cases

Key Features

Use Cases