Skip to content
SOC Health Check
Start your health check

Early access

Operationalize the XSIAM you already own.

Know what to do now, this week, and at 30, 60, and 90 days. Afigima AI is on your side of the rollout.

Start your health checkSee a sample report

This tool only reads data and never makes changes. Sign in

For the customer

On your side of the rollout

  • An AI guide for XSIAM customers

    Coming soon

    It will coach you on the questions to ask before you choose a partner, onboarding tips, things to avoid, and how to run or build your own checks.

  • Guided by engineers who have delivered it

    Engineers on our team have delivered XSIAM onboarding. Their experience guides the advice in the guide.

  • Your data stays separate

    We can advise you through the process without seeing your data or knowing exactly what you are working on. The health check is separate, and it only reads when you connect a key.

  • Cut rollout costs

    Know what you're paying for, track scope and progress yourself, and avoid paying for hours you don't need.

Sample data. Not a customer result.Northwind

You are here

Level 2 of 5 · Visibility 45%

  1. 1. Foundation

    88%

  2. 2. Visibility

    45%

  3. 3. Detection

    —

  4. 4. Response

    —

  5. 5. Optimization

    —

Areas

  • Agent Management

    84%

  • Broker VMs

    88%

  • Security Profiles

    91%

  • Data Sources

    45%

Before and after

Overall 65 now, about 94 after these actions.

Moves your score most

  1. 1

    Data Ingestion Health

    About a day

    Confirm metrics_source recorded byte volume by vendor, product, and collector type.

    About 11 points.

  2. 2

    Silent or Stale Sources

    About a day

    Flag sources whose last event is older than 24 hours and day-over-day volume drops.

    About 10 points.

  3. 3

    Parsing and Modeling Health

    About a day

    List raw datasets that still hold data, plus the health-domain issue count.

    About 9 points.

Data Sources

You're at Level 1. These 3 things get you to Level 2.

  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  • Level 1. Brokers, endpoints, prevention profiles, and whether a user has logged in are read from the tenant.
  • Level 2. Ingestion bytes, silent sources, and raw datasets are read from the tenant.
  • Level 3. Security-issue volume, indicator expiration, and MITRE mappings on rules are read from the tenant.
  • Level 4. New cases, playbook runs, and exposed assets are read from the tenant.
  • Level 5. Scheduled queries and daily ingestion bytes are read from the tenant.

  • Silent or Stale Sources

    About a day

    Flag sources whose last event is older than 24 hours and day-over-day volume drops.

  • Parsing and Modeling Health

    About a day

    List raw datasets that still hold data, plus the health-domain issue count.

  • Data Ingestion Health

    About a day

    Confirm metrics_source recorded byte volume by vendor, product, and collector type.

Agent Management

You're at Level 1. This area is in place.

  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  • Level 1. Brokers, endpoints, prevention profiles, and whether a user has logged in are read from the tenant.
  • Level 2. Ingestion bytes, silent sources, and raw datasets are read from the tenant.
  • Level 3. Security-issue volume, indicator expiration, and MITRE mappings on rules are read from the tenant.
  • Level 4. New cases, playbook runs, and exposed assets are read from the tenant.
  • Level 5. Scheduled queries and daily ingestion bytes are read from the tenant.

Broker VMs

You're at Level 1. This area is in place.

  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  • Level 1. Brokers, endpoints, prevention profiles, and whether a user has logged in are read from the tenant.
  • Level 2. Ingestion bytes, silent sources, and raw datasets are read from the tenant.
  • Level 3. Security-issue volume, indicator expiration, and MITRE mappings on rules are read from the tenant.
  • Level 4. New cases, playbook runs, and exposed assets are read from the tenant.
  • Level 5. Scheduled queries and daily ingestion bytes are read from the tenant.

Security Profiles

You're at Level 1. This area is in place.

  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  • Level 1. Brokers, endpoints, prevention profiles, and whether a user has logged in are read from the tenant.
  • Level 2. Ingestion bytes, silent sources, and raw datasets are read from the tenant.
  • Level 3. Security-issue volume, indicator expiration, and MITRE mappings on rules are read from the tenant.
  • Level 4. New cases, playbook runs, and exposed assets are read from the tenant.
  • Level 5. Scheduled queries and daily ingestion bytes are read from the tenant.

Customer scope summary

This summary is ours. Tenant: Northwind.

Add an action and it is written here, in our words.

The challenge

Ingestion and tuning stall the tenant you already own.

  • Ingestion gaps

    Sources you count on are missing, or they have gone quiet.

  • Alert noise

    Issues stay noisy, and tuning never quite finishes.

  • Unclear next steps

    Onboarding stalls when the next action is not written down.

How it works

Four steps. Then a plan.

  1. 01

    Connect

    Add a Cortex API key. This tool only reads data and never makes changes.

  2. 02

    Check

    Run the check. It reads ingestion, tuning, and the rest of the tenant.

  3. 03

    Level

    Overview shows your maturity level and the area scores beside it.

  4. 04

    Do this now

    Act on the three fixes to start with. The steps are written for the console.

What you get

A level, the areas, and what to do next.

Each level has its own score, grounded in cited best practice. Your goals come first.

  1. 1

    Foundation

    The key works, and agents and brokers are reporting.

  2. 2

    Visibility

    The data you count on is arriving and parsed.

  3. 3

    Detection

    Noise is named after that data is trustworthy.

  4. 4

    Response

    Cases and playbooks follow detections you trust.

  5. 5

    Optimization

    Automation and headroom, after response is real.

  • Five maturity levels

    Foundation through Optimization. Each level has its own score.

  • Area scores

    Measured areas show a percent. An unmeasured area says Not scored yet.

  • A prioritized plan

    Overview says what to do now, this week, and at 30, 60, and 90 days.

  • Steps, and an advisor

    The console steps are written out. Get help fixing this sends a request to expert advisors.

Talk to an advisor after the check. The button in Overview is Get help fixing this.

Who it's for

The people who have to make this tenant useful.

  • SOC managers and leads

    • See which sources went quiet.
    • See which issue names still dominate.
    • Leave with a plan for now, this week, and 30, 60, and 90 days.

  • Security engineers and detection owners

    • Ingestion, parsing, and tuning in one place.
    • Console steps you can follow.
    • A re-check that shows what moved.

  • CISOs and IT leaders

    • Five levels you can show as they are.
    • Owners and effort on the plan.
    • The same tenant, compared with the last check.

  • MSSPs and partners

    • The same check on each tenant you connect.
    • The same five levels, tenant by tenant.
    • An advisor request when a tenant wants help.

If the tenant already has AES

The check includes AES only when it is already licensed. It does not ask you to add it.

A partner can help you size and price AES for your environment.

Trust

Read-only by design.

  • It only reads

    This tool only reads data and never makes changes.

  • The key stays hidden

    The key is encrypted before it is stored. The portal shows the key ID, not the secret.

  • Independent

    Independent educational tool. Not affiliated with or endorsed by Palo Alto Networks. Informational only, not professional advice.

Christy Mendoza

About

Christy Mendoza

Christy Mendoza is the founder of Afigima Enterprises. Afigima AI is its service division, built to make complex security operations simpler. Cortex XSIAM is its first focus, with more services to come.

She built this site so security teams have one calm, clear place to see where their XSIAM setup stands and what to do next. Teams that are still onboarding get a guided path step by step. Teams already running XSIAM get their current setup gathered, scored against each maturity level, and turned into a short improvement plan. Behind it is a small team that shares her drive to make complex things simple.

FAQ

What do I need to run a check?

Early access. Create an account, connect a Cortex API key, and you land on Overview.

Does the check change my tenant?

No. This tool only reads data and never makes changes.

Who is it for?

SOC leads, detection owners, leaders showing the value of the tenant, and partners running many tenants.

Is this a Palo Alto Networks product?

Independent educational tool. Not affiliated with or endorsed by Palo Alto Networks. Informational only, not professional advice.

What are the five levels?

Each level has its own score, grounded in cited best practice. Your goals come first.

How do I re-check?

Re-checks run weekly or every two weeks and show what moved. You can also run one whenever you want.

Can I remove the key?

Yes. Delete the connection in the portal. The stored secret is removed with it.

Operationalize the XSIAM you already own.

This tool only reads data and never makes changes.

Start your health checkSign in
SOC Health Check | Operationalize the XSIAM you already own