The operating layer for security operations on Cortex XSIAM, and the lifecycles that run on it. The framework makes any lifecycle vendor-agnostic, safe to run and measurable: every vendor action goes through one command, every changing action ships simulated until it is switched on, and every action writes one row with the analyst minutes it stands for. A lifecycle, such as NIST IR AI, decides what to ask and when to act; the framework decides how an action is carried out, on which vendor, whether it really runs, and what gets recorded.
Documentation: palo-cortex.github.io/secops-framework
| You want to | Go to |
|---|---|
| Understand what the framework is and what a lifecycle is, in one page | Framework and Lifecycle |
| Stand it up on a tenant and see what it would do, without changing anything | Evaluate — install takes about 30 minutes |
| Keep producing the same measures in production | Deploy to production |
| Write content that fits the framework and get it through the gates | Build on the framework |
| Look up one capability: its switch, how to turn it on, how to verify it | Reference |
| Find out why something did not behave | Support |
| Path | What it holds |
|---|---|
Packs/soc-optimization-unified/ |
The framework: the universal command, Shadow Mode, lists, datasets, scripts, dashboards. Its README is the capability catalog. |
Packs/soc-framework-nist-ir-ai/ |
The NIST IR AI lifecycle: assessment, close decision, case analysis, layouts, dashboards. |
ai/nist-ir/ |
The lifecycle's hand-deployed playbooks and prompt recipes, with their release notes. |
Packs/soc-* |
Vendor packs: one per data source, generated from a contract under schemas/vendors/. |
schemas/ |
The contracts the content is generated from and validated against. |
tools/ |
The gates and generators: check_contribution.py before every commit, prep_docs.py for the docs. |
docs/ |
The site source. docs/nav.yml is the site map; generated pages carry a banner and are never edited by hand. |
Releases are cut per pack from main; tenants install them through the SOC Framework Pack Manager. See Contributing and the Build tab for the branch, gate and release flow.
See LICENSE.txt.