• DATA
  • PATTERNS
  • ANALYSIS
  • HUMAN

How to run custom threat hunting with your AI

Connect Cortex XSIAM to your AI client to turn natural language requests into precise security queries. You'll move from asking questions to seeing raw telemetry instantly.

Ask AI about this page

Short answer

Can I run XQL queries using my AI?

Yes. Your AI uses the run_xql_query tool to translate your hunting questions into valid XQL syntax and execute them against your Cortex XSIAM instance. This gives you direct access to logs and telemetry through a chat interface.

The outcomes

What you get from hunting

Every query you run delivers specific security intelligence back to your chat window.

DATA

Raw telemetry access

The AI pulls specific logs and event data based on your query. You get the exact artifacts needed for investigation.

PATTERNS

Malicious activity detection

Your agent identifies suspicious sequences or repeated patterns in your environment. It finds the needle in the haystack.

ANALYSIS

Automated query drafting

The AI handles the complex XQL syntax for you. You focus on the logic while it handles the code.

HUMAN

Manual verification required

You must review the query results to confirm findings. The AI provides the data, but you make the final call on threats.

The workflow

What your AI does when you hunt.

The AI acts as the bridge between your intent and the XSIAM data lake.

  1. Translate intent

    Your agent takes your plain English description of a threat and converts it into a structured query.

    run_xql_query

  2. Execute search

    The AI sends the generated command to Cortex XSIAM to scan your environment.

    run_xql_query

  3. Parse results

    The agent reads the returned data and organizes it so it's readable in your chat window.

    run_xql_query

  4. Summarize findings

    The AI highlights the specific artifacts or suspicious IPs found during the hunt.

    run_xql_query

Try it

Copy these to start.

Use these prompts to kick off a hunt immediately.

Starting points

These are templates. Swap out the specific IP addresses, hostnames, or file names to match your current investigation.

Cortex XSIAM Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Cortex XSIAM capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "cortex-xsiam-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp"
    }
  }
}
Copy into chat04

  • Run an XQL query to find all failed login attempts from IP 192.168.1.50 in the last 24 hours.

  • Search for any process executions involving 'powershell.exe' that occurred on workstation-alpha-01.

  • Find all network connections to external domain 'malicious-site.com' from the last hour.

  • Query for any unusual file modifications in the /etc/ directory across all Linux endpoints.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Cortex XSIAM once, then ask.

Just link your account once. Your credentials stay encrypted, and you can start hunting in any MCP-compatible client.

Connect Cortex XSIAM to your AI

FAQ

How the hunting works

  • 01

    Can the AI change my XSIAM configurations?

    No. The AI only has the ability to run queries. It cannot modify settings, delete logs, or change security policies.

  • 02

    Does the AI write the XQL for me?

    Yes. It translates your natural language into the specific XQL syntax required by Cortex XSIAM.

  • 03

    Can the AI automatically block an IP address?

    No. The AI can find the IP address using a query, but it cannot take any remediation or blocking actions.

  • 04

    What happens if the XQL query is wrong?

    The AI will attempt to correct the syntax based on the error returned by XSIAM. You can also manually tell it to fix the query.

  • 05

    Do I need to know XQL to use this?

    No. The main benefit is that you can hunt using plain English without needing to be an XQL expert.

  • More questions about Cortex XSIAM? The Connector page answers them. See everything the Cortex XSIAM Connector can do

Connect Cortex XSIAM to Claude, Cursor, ChatGPT & more