Skip to content
Discovery Lab
Get the guide

Get your XSIAM rollout on track, with engineers who've delivered it

Read-only. Independent. Invoice or PO accepted.

Get the guide

This tool only reads data and never makes changes. Sign in

What's included

  • The XSIAM guide
  • The checker kit
  • The health check
  • Includes a 2-hour consultation with our engineers, booked within 30 days
  • Access by email right after checkout

Contents

  1. Before buying

    Cut rollout cost before you hire help. Ask for a scope you can count, a window for each data source, and a sentence that means done.

  2. Onboarding

    Use the first 90 days as a review rhythm. The full window is 180 days. A week is a checkpoint. Sign-off still waits on the work.

  3. Things to avoid

    Each item below is time you can avoid spending twice. Fix the data path before you pay for tuning on top of it.

  4. Start here

    One checker. Four ways to run it. The check id, the severity weight, and the maturity level stay the same on every rung.

  5. Build your own checker

    The catalog behind every rung. It does not add a check that this list does not have.

  6. Run the check in your tenant

    The download is the same checker. Start here picks the rung. Each check page shows the four formats.

Read a sample chapter

Who it's for

  • A customer SOC lead or manager who is starting an XSIAM rollout or already running one.

Who it's not for

  • Someone who wants this tool to hold their Cortex API key. The checker key stays on your machine.
  • A request for Palo Alto Networks support. This site is independent.

Security and data handling

The health check only reads. The checker key stays on your machine. Card details are entered on Stripe Checkout.

Read the security statement

Questions

Can an administrator open the guide for someone?

Yes. An administrator can grant the guide to a work email. That grant does not approve the health check.

Are you affiliated with Palo Alto Networks?

No. Independent educational tool. Not affiliated with or endorsed by Palo Alto Networks. Informational only, not professional advice.

How does the consultation get booked?

After access, Start here includes one 2-hour consultation with our engineers. It is booked within 30 days of the day access starts.

Can we pay by invoice or purchase order?

Yes. Use Need an invoice or PO? We send that note to the team and invoice it separately. The guide opens after payment is recorded, or after an administrator grants it.

What if the tenant is still early?

You can read the guide without connecting a tenant. The checker runs on your machine, against a tenant you choose, and it only reads.

How long does access last?

The guide stays on that work email. This site does not remove it on a date. The consultation is booked within 30 days of the day access starts.

Get the guide

See an example report (sample data)
Example dataNorthwind

You are here

Level 2 of 5 · Visibility 45%

  1. 1. Foundation

    88%

  2. 2. Visibility

    45%

  3. 3. Detection

    —

  4. 4. Response

    —

  5. 5. Optimization

    —

Areas

  • Agent Management

    84%

  • Broker VMs

    88%

  • Security Profiles

    91%

  • Data Sources

    45%

Before and after

Overall 65 now, about 94 after these actions.

Moves your score most

  1. 1

    Data Ingestion Health

    About a day

    Confirm metrics_source recorded byte volume by vendor, product, and collector type.

    About 11 points.

  2. 2

    Silent or Stale Sources

    About a day

    Flag sources whose last event is older than 24 hours and day-over-day volume drops.

    About 10 points.

  3. 3

    Parsing and Modeling Health

    About a day

    List raw datasets that still hold data, plus the health-domain issue count.

    About 9 points.

Data Sources

You're at Level 1. These 3 things get you to Level 2.

  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  • Level 1. Brokers, endpoints, prevention profiles, and whether a user has logged in are read from the tenant.
  • Level 2. Ingestion bytes, silent sources, and raw datasets are read from the tenant.
  • Level 3. Security-issue volume, indicator expiration, and MITRE mappings on rules are read from the tenant.
  • Level 4. New cases, playbook runs, and exposed assets are read from the tenant.
  • Level 5. Scheduled queries and daily ingestion bytes are read from the tenant.

  • Silent or Stale Sources

    About a day

    Flag sources whose last event is older than 24 hours and day-over-day volume drops.

  • Parsing and Modeling Health

    About a day

    List raw datasets that still hold data, plus the health-domain issue count.

  • Data Ingestion Health

    About a day

    Confirm metrics_source recorded byte volume by vendor, product, and collector type.

Agent Management

You're at Level 1. This area is in place.

  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  • Level 1. Brokers, endpoints, prevention profiles, and whether a user has logged in are read from the tenant.
  • Level 2. Ingestion bytes, silent sources, and raw datasets are read from the tenant.
  • Level 3. Security-issue volume, indicator expiration, and MITRE mappings on rules are read from the tenant.
  • Level 4. New cases, playbook runs, and exposed assets are read from the tenant.
  • Level 5. Scheduled queries and daily ingestion bytes are read from the tenant.

Broker VMs

You're at Level 1. This area is in place.

  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  • Level 1. Brokers, endpoints, prevention profiles, and whether a user has logged in are read from the tenant.
  • Level 2. Ingestion bytes, silent sources, and raw datasets are read from the tenant.
  • Level 3. Security-issue volume, indicator expiration, and MITRE mappings on rules are read from the tenant.
  • Level 4. New cases, playbook runs, and exposed assets are read from the tenant.
  • Level 5. Scheduled queries and daily ingestion bytes are read from the tenant.

Security Profiles

You're at Level 1. This area is in place.

  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  • Level 1. Brokers, endpoints, prevention profiles, and whether a user has logged in are read from the tenant.
  • Level 2. Ingestion bytes, silent sources, and raw datasets are read from the tenant.
  • Level 3. Security-issue volume, indicator expiration, and MITRE mappings on rules are read from the tenant.
  • Level 4. New cases, playbook runs, and exposed assets are read from the tenant.
  • Level 5. Scheduled queries and daily ingestion bytes are read from the tenant.

Customer scope summary

This summary is ours. Tenant: Northwind.

Add an action and it is written here, in our words.

Choose a category

Next level: Visibility

Visibility stays open until these checks are in place. Coverage: the planes you intend to detect on are arriving and parsed.

  • Silent or Stale Sources · warning

    Fix: Repair a source that stopped sending or dropped by half day over day.

  • Parsing and Modeling Health · warning

    Fix: Map raw datasets into the data model. Parsing-rule files are a console review.

  • Data Ingestion Health · fail

    Fix: Configured sources should show total_size_bytes in metrics_source.

Run this on your own tenant

Get the guide
OPTIV + PALO ALTO NETWORKS · CORTEX · FY26