topic Re: Cortex XDR Incident Best Practices in Cortex XDR Discussions

Cortex XDR Incident Best Practices

Jeroen_Proost — Thu, 30 Mar 2023 14:10:06 GMT

Hello,

I know this migth not easy to answer, but I'm going to take my chance anyway.
Are there any incident best practices for (each) Cortex XDR detector documented ? For example what a certain detector means, what the best thing is to do in this case, ...

Thank you very much,

Re: Cortex XDR Incident Best Practices

mavraham — Thu, 30 Mar 2023 14:42:15 GMT

Hi @Jeroen_Proost,

Thank you for writing to live community. This indeed sounds like a very broad subject. Do you think you can elaborate a bit on what you mean or what you're hoping to achieve?

This can be taken in multiple different directions - alert tunings, incident sources, analytics detection time intervals.

Re: Cortex XDR Incident Best Practices

Jeroen_Proost — Fri, 31 Mar 2023 06:32:55 GMT

Hello @mavraham ,

Thank you very much for your reply.
Indeed, maybe this is even nearly impossible or would take a very long time to document. I want to create a guideline, or maybe even an incident response plan, not only for myself but also for my colleagues just to be sure I am doing the right thing in case of an incident.
I know such things should rely on experience, but at the moment, I lack of that.

I want to learn, know what to do, gain experience,... I will definitely check out the links you included, thank you for that.

Re: Cortex XDR Incident Best Practices

jcandelaria — Tue, 04 Apr 2023 06:06:55 GMT

@Jeroen_Proost

Check out our webinars (link below and with the help of SmartScore feature (link below), this will help/guide Analyst which incident to prioritize and investigate.

You can explore our journey phases in our Live Community page and select whether you have Prevent or Pro license.

https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/customer-success-webinar-cortex-xdr-soc-analysts-understanding/ta-p/488372

https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-alert-tuning-operations/ta-p/505838

https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/cortex-xdr-how-to-video-smartscore/ta-p/513374

Re: Cortex XDR Incident Best Practices

Jeroen_Proost — Tue, 11 Apr 2023 09:12:20 GMT

Thank you very much @jcandelaria !