To scale effectively, security teams need SOAR to standardize and automate day-to-day tasks and processes across 3rd party products and services. Your SIEM events, including log data, alerts, query results, and enriched context are essential input for your SOAR workflows. Cortex XSOAR enables you to integrate the rich data, context, and alerts from your SIEM by installing prebuilt content packs with a single click from the in-product Cortex XSOAR Marketplace.
Splunk and QRadar are the top leveraged SIEM content packs used with Cortex XSOAR today. Recent updates to these content packs deliver new capabilities and improvements to speed the time to value during onboarding and reduce the management overhead of using Cortex XSOAR to connect, automate, and simplify your SOC workflows.
The latest updates of these content packs utilize Cortex XSOAR’s unique case management features to deliver an advanced user experience including:
- Quick onboarding with prepopulated assets, SIEM schema, and custom field mapping
- Prebuilt customizable orchestration playbooks automate end-to-end SOC workflows
- Augmented dashboards mirror SIEM layouts and enhance visibility across incidents
- Native threat intelligence management for extended context enrichment
- Smart collaboration features enable ticket mirroring across systems, effortless team communication, automated metrics, and much more
Both the QRadar and Splunk content packs continuously fetch incident information and provide additional enrichment around assets - to give you real-time access to the same data and events available in each product - but with more context and control in Cortex XSOAR. With the latest update, we now provide ticket mirroring between both systems and auto-population of incident mapping for dozens of standard and custom event fields to cover the unique data schema you have developed in your SIEM. These updates streamline integration, workflows, and data between your SIEM and Cortex XSOAR to enable the use of a singular interface approach to save time for your team and simplify your security program.
Whether you are using Splunk or QRadar as your primary SIEM, it has never been easier to manage your SIEM incidents and improve your SOC workflows with Cortex XSOAR.
Learn more
To learn more about these updated content packs, join us on May 27 at 9:00 AM PST for the webinar “Cortex® XSOAR Marketplace Top Use Cases Webinar,” and discover how to elevate your Splunk and QRadar SIEM workflows to the next level. We will provide an overview and demo of both content packs and answer your questions during the live event.