Cortex Components in plain english / non-secops terms

KPawlak — Wed, 26 May 2021 21:21:19 GMT

In a lot of conversations recently I've found that many, many people are confused by the names and functions of Cortex - especially given the rapid expansion of the platform. In this post I'm going to try to distill the basics of each product with as little jargon as I can and help people figure out which things they are and are not looking for from the platform.

"Cortex" -> name of the overall product platform for enabling Security Operations teams, technologies, and workflows. All other components referenced below are a part of this platform

Cortex XDR Prevent -> Endpoint Protection agent. Table of capabilities here. Modules and OS coverage here. This solution is designed to protect endpoints from various types of compromise and builds upon the concepts of Anti-Virus and NGAV that the industry have leveraged for years. This includes, but is not limited to, the protections of our legacy endpoint protection tool "Traps"

Cortex XDR Pro (for endpoint) -> same agent as above, but with EDR functionality enabled. EDR gathers important forensic data from endpoints and feeds into the combined Cortex platform (architecture described here) to allow Palo Alto Networks to detect many more types of threats in your environment. Detection coverage discussed within our docs here (see sections that include 'XDR agent' as data sources) as well as analyzed by MITRE, a 3rd party organization.

Cortex XDR Pro (per TB) -> same Cortex platform for analytics and threat detection, but augmenting the EDR data set with Firewall logs and 3rd party data. See here to understand use case coverage (all sections that do not require the XDR agent can be accomplished with this license alone).

Cortex XSOAR -> Orchestration and Automation platform for designing, documenting, and automating security and incident response workflows. Some top use cases are referenced here

Cortex Xpanse -> discover your attack surface from the outside / attacker perspective.

This has many, many applications. For example, when acquiring or merging with another business it can allow you to do strong due diligence on their security posture before your unify your organizations or complete a purchase.

Or when a new vulnerability is released such as CVE-2021-21985 and Ars Technica writes that Shodan has already discovered 5K vulnerable servers on the internet on the same day, you might be thinking 'uh oh, is one of them ours? do we need to go into full incident response mode?". Normally you'd go try to pull some asset inventory or something to figure it out, but hey maybe someone spun up something you didn't know about in an IaaS provider and it isn't encompassed in there. That's stressful ... well XPanse, by scanning the whole internet, would be able to tell you if you needed to get to work ASAP or if you can sit this one out!

Re: Cortex Components in plain english / non-secops terms

gjenkins — Tue, 20 Jul 2021 22:41:09 GMT

Thank you!

topic Cortex Components in plain english / non-secops terms in Cortex XDR Discussions

Cortex Components in plain english / non-secops terms

Re: Cortex Components in plain english / non-secops terms