Early access
Operationalize the XSIAM you already own.
Know what to do now, this week, and at 30, 60, and 90 days.
This tool only reads data and never makes changes. Sign in
You are here
Level 2 of 5 · Visibility 45%
1. Foundation
87%
2. Visibility
45%
3. Detection
—
4. Response
—
5. Optimization
—
Areas
Broker VMs
88%
Endpoint Security
84%
Data Sources
45%
Data & Detection
41%
Alert & Incident Management
Not scored yet
Do this now
A source has gone quiet
Needs attention
One issue name keeps repeating
Improve
Parsing left events unused
Needs attention
The challenge
Ingestion and tuning stall the tenant you already own.
Ingestion gaps
Sources you count on are missing, or they have gone quiet.
Alert noise
Issues stay noisy, and tuning never quite finishes.
Unclear next steps
Onboarding stalls when the next action is not written down.
How it works
Four steps. Then a plan.
01
Connect
Add a Cortex API key. This tool only reads data and never makes changes.
02
Check
Run the check. It reads ingestion, tuning, and the rest of the tenant.
03
Level
Overview shows your maturity level and the area scores beside it.
04
Do this now
Act on the three fixes to start with. The steps are written for the console.
What you get
A level, the areas, and what to do next.
Each level has its own score, grounded in cited best practice. Your goals come first.
1
Foundation
The key works, and agents and brokers are reporting.
2
Visibility
The data you count on is arriving and parsed.
3
Detection
Noise is named after that data is trustworthy.
4
Response
Cases and playbooks follow detections you trust.
5
Optimization
Automation and headroom, after response is real.
Five maturity levels
Foundation through Optimization. Each level has its own score.
Area scores
Measured areas show a percent. An unmeasured area says Not scored yet.
A prioritized plan
Overview says what to do now, this week, and at 30, 60, and 90 days.
Steps, and an advisor
The console steps are written out. Get help fixing this sends a request to expert advisors.
Talk to an advisor after the check. The button in Overview is Get help fixing this.
Who it's for
The people who have to make this tenant useful.
SOC managers and leads
- See which sources went quiet.
- See which issue names still dominate.
- Leave with a plan for now, this week, and 30, 60, and 90 days.
Security engineers and detection owners
- Ingestion, parsing, and tuning in one place.
- Console steps you can follow.
- A re-check that shows what moved.
CISOs and IT leaders
- Five levels you can show as they are.
- Owners and effort on the plan.
- The same tenant, compared with the last check.
MSSPs and partners
- The same check on each tenant you connect.
- The same five levels, tenant by tenant.
- An advisor request when a tenant wants help.
If the tenant already has AES
The check includes AES only when it is already licensed. It does not ask you to add it.
A partner can help you size and price AES for your environment.
Trust
Read-only by design.
It only reads
This tool only reads data and never makes changes.
The key stays hidden
The key is encrypted before it is stored. The portal shows the key ID, not the secret.
Independent
Independent educational tool. Not affiliated with or endorsed by Palo Alto Networks. Informational only, not professional advice.
About
Christy Mendoza
Christy Mendoza is the founder of Afigima Enterprises. Afigima AI is its service division, built to make complex security operations simpler. Cortex XSIAM is its first focus, with more services to come.
She built this site so security teams have one calm, clear place to see where their XSIAM setup stands and what to do next. Teams that are still onboarding get a guided path step by step. Teams already running XSIAM get their current setup gathered, scored against each maturity level, and turned into a short improvement plan. Behind it is a small team that shares her drive to make complex things simple.
FAQ
What do I need to run a check?
Early access. Create an account, connect a Cortex API key, and you land on Overview.
Does the check change my tenant?
No. This tool only reads data and never makes changes.
Who is it for?
SOC leads, detection owners, leaders showing the value of the tenant, and partners running many tenants.
Is this a Palo Alto Networks product?
Independent educational tool. Not affiliated with or endorsed by Palo Alto Networks. Informational only, not professional advice.
What are the five levels?
Each level has its own score, grounded in cited best practice. Your goals come first.
How do I re-check?
Re-checks run weekly or every two weeks and show what moved. You can also run one whenever you want.
Can I remove the key?
Yes. Delete the connection in the portal. The stored secret is removed with it.
Operationalize the XSIAM you already own.
This tool only reads data and never makes changes.