topic Cortex XDR - How We Distinguish Ourselves From a SIEM Solution in Cortex XDR Discussions

Cortex XDR - How We Distinguish Ourselves From a SIEM Solution

nhussaini — Fri, 05 Nov 2021 03:18:17 GMT

When running a SIEM, you need to have a huge team of many Analysts Level 1, Level 2, Level 3… Escalations to lateral teams (sometimes to take actions such as isolating endpoints/servers, gathering/deleting suspicious files, etc). It is laborious and time consuming to perform simple actions, like creating an alert.

Read Cortex XDR - How We Distinguish Ourselves From a SIEM Solution to learn more on this topic from our experts!

Palo Alto Networks Contributors:

Luis Escobar, Cortex Customer Success Architect

Maor Hojberg, Technical Marketing Engineer

Re: Cortex XDR - How We Distinguish Ourselves From a SIEM Solution

SStonebraker — Tue, 02 Nov 2021 20:41:35 GMT

Cortex XDR lacks a unified data model which impedes the ability to rapidly perform useful searches across disparate datasets. Are there plans to address that gap?

Re: Cortex XDR - How We Distinguish Ourselves From a SIEM Solution

eluis — Wed, 03 Nov 2021 16:23:54 GMT

Hi SStonebraker,

if you mean that Cortex XDR doesn't have a dataset that holds all the datasets, that is correct. But so far we dont need that because in Cortex XDR, you can query and search with XQL any dataset and a combination of them in a very good response time. Creating a dataset of datasets will screw the searches response and so far there is no point to do so.

On top of that we have Cortex XDR Collectors that can collect data/logs from a miriad of sources ftp, linux system logs, windows, webservers of many flavors (IIS, apache, nginx), Fw, you name it. Once that those logs are uploaded in our Cortex management console in the cloud you can perform XQL queries on them.

Additionally you can save the XQL queries in a public area so you and all your work mates can reuse them without reinventing the wheel.

You can also save the queries as correlation rules and set the timing to launch them...

As a source for XQL query center documentation, please visit the link:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/search-queries/query-center

From there you can also jump to other very good XQL documentation sources.

Hope this helped.

Kind Regards,

Luis

Re: Cortex XDR - How We Distinguish Ourselves From a SIEM Solution

eumbach — Sat, 13 Nov 2021 02:45:22 GMT

PAN Cortex XDR isn't a SIEM!

Also PAN check out Cortex XDR 3.0 now with correlation searches and the ability to ingest data from anywhere!!!

😄