Set Alert Sources

task brazil Updated Sep 10, 2026 1 min read pan-cortex-xsiam-rules.md

Select Alert Sources to map corresponding incidents to a security incident. Alert Sources are refreshed every time a profile is opened and new rules are available for selection. The Cortex XSIAM integration supports multiple profiles.

Before you begin

Role required: sn_si.admin, sn_si.ingestion_profile_admin

Procedure

If you are not continuing from the previous section of the incident profile definition process, access the profile you are defining.
1. Navigate to All > Palo Alto Networks XSIAM > XSIAM Profile.
2. Select the profile you are continuing to define.
3. Select Alert Sources in the progress bar.
Clear the All Alert Sources check box to select specific Alert Sources.

Selecting this check box will retrieve all active Alert Sources from XSIAM.
In the Alert Sources List search field, enter the Alert Source name created in the XSIAM portal.
Select the Alert Source.
Use the right arrow ( >) to move the rule from Available to Selected column.

[Omitted image "xsiam-alert-sources.png"] Alt text: Set Alert Sources
Select Continue.

What to do next

Map incident fields

52 lines · 2.1 KB Wrap lines

---
title: Set Alert Sources
description: Select Alert Sources to map corresponding incidents to a security incident. Alert Sources are refreshed every time a profile is opened and new rules are available for selection. The Cortex XSIAM integration supports multiple profiles.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/pan-cortex-xsiam-rules.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Security Incident Response Integration with Cortex XSIAM by Palo Alto Networks, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Set Alert Sources

## Before you begin

Role required: sn\_si.admin, sn\_si.ingestion\_profile\_admin

## Procedure

1. If you are not continuing from the previous section of the incident profile definition process, access the profile you are defining.

1. Navigate to **All** &gt; **Palo Alto Networks XSIAM** &gt; **XSIAM Profile**.

2. Select the profile you are continuing to define.

3. Select **Alert Sources** in the progress bar.

2. Clear the **All Alert Sources** check box to select specific Alert Sources.

Selecting this check box will retrieve all active Alert Sources from XSIAM.

3. In the Alert Sources List search field, enter the Alert Source name created in the XSIAM portal.

4. Select the Alert Source.

5. Use the right arrow **\( &gt;\)** to move the rule from **Available** to **Selected** column.

\[Omitted image "xsiam-alert-sources.png"\] Alt text: Set Alert Sources

6. Select **Continue**.

## What to do next

[Map incident fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/pan-cortex-xsiam-mapping.md)