Hydden identity data in Cortex XSIAM
Updates to the Hydden MCP. Analysts and agents in Cortex XSIAM pull identity data on demand from inside the Cortex UI.
Why it's important
Cortex XSIAM uses the Hydden MCP from inside its own UI. The MCP exposes accounts, entitlements, privilege and anomaly findings, activity, and reviews to MCP clients over HTTPS with OAuth 2.0 client credentials.
The problems this feature solves
Identity lookups during an incident usually happen in a second console. An analyst leaves Cortex XSIAM to find the account, its entitlements, and what it can reach.
Questions from an agent usually leave the Cortex interface. The answer about an identity then comes back from somewhere else.
A client that can read the identity record may also be allowed to change it. Disable, deprovision, group and role changes, notify, open a ticket, and vault need their own permission, separate from a lookup.
What the feature does
Hydden events for human accounts, non-human identity accounts, and AI agent accounts land in Cortex dashboards for event volume, top privileged identities, and new accounts.
The blast radius and deprovisioning playbooks can disable or deprovision an account, change a group or role, notify, open a ticket, or vault.
The identity data Cortex pulls includes human accounts, non-human identity accounts, and AI agent accounts.
An agent in Cortex asks Hydden questions through the Hydden MCP and stays in the Cortex interface.
Cortex XSIAM connects through the Generic MCP content pack. Each credential sees only the tools its roles allow, and the blast radius playbook includes a blast radius command.
Questions
How does Cortex XSIAM connect to Hydden?
Through the Generic MCP content pack. The Hydden MCP serves identity data over HTTPS with OAuth 2.0 client credentials.
What identity data can Cortex pull?
Accounts, entitlements, privilege and anomaly findings, activity, and reviews. That includes human accounts, non-human identity accounts, and AI agent accounts.
What can a credential do?
The tools a client sees are scoped by the credential’s roles. The actions are account disable or deprovision, group and role changes, notify, open a ticket, and vault.
What shows up in Cortex?
Two Hydden playbooks, blast radius and deprovisioning, including a blast radius command. Hydden events also land in Cortex dashboards for event volume, top privileged identities, and new accounts.
See Hydden identity data in Cortex XSIAM
Request a trial and connect Cortex through the Generic MCP content pack.