10-14-2021 10:56 AM - last edited on 11-04-2021 09:29 AM by jennaqualls
Ask your questions from October 14 through October 26 as the Education Services Team experts will be available in a Q&A session for an opportunity to learn, join in, ask questions, and meet our experts! The Ask Me Anything (AMA) Event is focused on Education Services Training and Credentialing Opportunities for Cortex.
Ask questions from Thursday, October 14 to Tuesday, October 26, 2021.
Come back on October 27 from 8 a.m. to 10 a.m. PT to join the event as our experts answer your questions!
To participate in this event, please use the Reply button below to ask your questions.
Please be sure to click Like if a post is helpful to you and to "Accept as Solution" to let everyone know that the answer to your question hits the mark!
Want to learn more details about the event? Check out this article.
10-27-2021 09:09 AM
@OmarDweik wrote:
i have two question
What the Different between Cortex and other EDR with Antivirus Definition ?
What is Content Update ?
One of the single most important differences between Cortex XDR and traditional static/dynamic definitional list protection (i.e. traditional antivirus) is that Cortex XDR provides behavioral analysis on top of WildFire’s file verdict. Contemporary malware, such as MiniDuke, utilize a customized backdoor for each target, written in assembler. Each target receives a unique dropper so traditional methods of analyzing a file based upon others having previously uploaded the same file will be bypassed entirely since every target is unique. In addition to traditional WildFire file verdicts, Cortex XDR uses Behavioral Threat Prevention and Behavioral Indicators of Compromise to detect the sort of activity overwhelmingly used to compromise systems rather than just specific SHA256 hashes or file names.
Content Updates come in the form of new Behavioral Indicator of Compromise rules, new hash updates, agent policy updates and more. An example of a very valuable content update was when Palo Alto pushed out content updates specifically for SolarStorm and the recent Microsoft Exchange compromise.
10-27-2021 09:10 AM
@OtakarKlier wrote:
Hello,
What are some of the training offerings for those with limited/no training budget who are trying to get into cyber?
Regards,
Palo Alto Networks Cybersecurity Academy has a number of free resources available, and with the use of a Beacon account, there are a number of free Digital Learning resources as well.
10-27-2021 09:12 AM
@agalindo wrote:
Are there any upcoming discounts for certifications?
Palo Alto Networks employees receive two free vouchers each year for Pearson certificates. Additionally, there are many certification discounts available from time to time on company emails, and on the Palo Alto Networks LiveCommunity website.
10-27-2021 09:17 AM
@S.Cantwell wrote:
What are the requirements to invited to the XDR201 for CPSP partners?
Is there a chance increase the number of XDR201 classes?
How do we test out of the 201 (meaning, we have many years of experience) that we can earn the associated micro-credentials.
In order to be invited to the XDR201 you need to have passed the XDR101 first.
The number of class offerings is based on the demand. If the classes are all full with a waitlist we will offer additional classes, there are 3 201 XDR classes in between Nov 15-Dec 3. So if you are interested please sign up!
We do not offer a method to test out of the XDR201 class prior to taking the Micro-Credential.
10-27-2021 09:32 AM
=================
One of the single most important differences between Cortex XDR and traditional static/dynamic definitional list protection (i.e.
traditional antivirus) is that Cortex XDR provides behavioral analysis on top of WildFire’s file verdict. Contemporary malware, such as MiniDuke, utilize a customized backdoor for each target, written in assembler. Each target receives a unique dropper so traditional methods of analyzing a file based upon others having previously uploaded the same file will be bypassed entirely since every target is unique. In addition to traditional WildFire file verdicts, Cortex XDR uses Behavioral Threat Prevention and Behavioral Indicators of Compromise to detect the sort of activity overwhelmingly used to compromise systems rather than just specific SHA256 hashes or file names.
My Response...
The Other EDR Vendor they have behavior and legacy With Sandbox verdict so it is more protection.
==================
Content Updates come in the form of new Behavioral Indicator of Compromise rules, new hash updates, agent policy updates and more. An example of a very valuable content update was when Palo Alto pushed out content updates specifically for SolarStorm and the recent Microsoft Exchange compromise.
My response:
Still not clear, as Palo alto they said we don't have update like other vendor (legacy AV) and based to your definition we can consider Content Update same other Antivirus Definition .
By the way at what level Content Update Applicable to Cortex XDR Layers
Prevention,Rule,Analysis & Response or data
10-27-2021 12:10 PM
@OmarDweik wrote: The Other EDR Vendor they have behavior and legacy With Sandbox verdict so it is more protection.
Sandboxing is different from Cortex XDR's in-line capabilities. Sandboxing, while important, can be identified by advanced malware that send WMI queries, perform other environment checks, or check which processes are running to see if they are operating within a sandbox.
On the other hand, Cortex XDR intercepts processes and prevents exploits by implementing roadblocks at each stage of the process, thus preventing behavioral threats by observing patterns throughout the entire process cycle. Malware can't evade this check like it can evade sandboxing (by remaining dormant), making Cortex XDR's protection more complete than traditional antivirus and sandboxing techniques. Case in point, the SolarStorm compromise performed a sandboxing check and went dormant for two weeks following the initial access and execution phase. This process successfully by-passed sandboxing attempts in traditional EDR platforms.
Sandboxing also adds unnecessary performance impact and user operation disruption when compared to the in-line protection provided by Cortex XDR. Competitors that have bet on sandboxing technology have had that problem since the beginning when compared to Cortex XDR.
Finally, XDR leverages sandbox technology by way of WildFire. While not native in XDR agents, this once more improves performance impact while providing better protection. This usage of WildFire sandboxing allows XDR to both prevent the activity locally while detonating in a sandboxing in the cloud to identify what the malware would have done on the endpoint, effectively giving Cortex XDR the best of both worlds.
10-27-2021 12:25 PM - last edited on 10-28-2021 01:21 PM by jdelio
@OmarDweik wrote:
- Can i delay Cortex 3.0 Services During Startup?
- there is Early Anti Malware Lunching features?
- can i control bandwidth With VM Broker?
Hi Omar!
Q: Can i delay Cortex 3.0 Services During Startup?
A: Yes. There are multiple ways to do this, depending on the platform and the need. VDI machines have a dedicated setting for delayed startup, this is part of the new VDI flow introduced in 7.2 (Windows only), it works automatically to ensure the best performance but can also be tuned with the help of Support teams should there be issues. Services startup can be controlled also for regular XDR Agents for Windows (cloud or not), by leveraging the OS native services control capabilities, but keep in mind that the drivers start earlier and are in limbo until cyserver is started, therefore unexpected behaviour might occur especially if there are security events at boot while the service is not running yet. It is not advisable to play with this. Other OSes like macOS and linux have similar native capabilities.
Q: there is Early Anti Malware Lunching features?
A: Yes, there is, we use a driver called ‘telam’ to register cyserver as a Windows Protected Process on modern versions of Windows.
Q: can i control bandwidth With VM Broker?
A: What bandwidth are you referring to? Bandwidth consumed due to installer downloads, CU downloads, Agent heartbeats, Broker upgrades, etc. Depending on which one you mean XDR may or may not have bandwidth control capabilities. However, all bandwidth control capabilities are handled by XDR, not the Broker VMs.
Thanks!
10-27-2021 12:41 PM
@OtakarKlier wrote:
Hello,
How is Cortex better/different than other XDR products on the market? Why should a company switch from their current product to Cortex?
Regards,
10-27-2021 02:55 PM - last edited on 10-28-2021 01:20 PM by jdelio
@nhussaini wrote:
How do education services trainings differ from live community trainings?
Hi Naresa!
We are not clear what resources you refer to exactly. In general, material found on Live comes in the form of blog posts, articles, white papers, "additional resources" of this kind. Whereas Education Services training offerings (e.g., EDU-260, EDU-261, ...) are full-blown courses, each with a different curriculum and set of objectives, they are delivered either in live classes with an instructor or through our online learning platforms. I hope it helps.
Thanks!
10-25-2021 10:59 AM
What training and certification offerings do you have for Cortex?
10-25-2021 09:29 PM
i have two question
What the Different between Cortex and other EDR with Antivirus Definition ?
What is Content Update ?
10-26-2021 08:24 AM
How do education services trainings differ from live community trainings?
10-27-2021 05:44 AM
What are the requirements to invited to the XDR201 for CPSP partners?
Is there a chance increase the number of XDR201 classes?
How do we test out of the 201 (meaning, we have many years of experience) that we can earn the associated micro-credentials.
10-27-2021 06:59 AM
Hello,
What are some of the training offerings for those with limited/no training budget who are trying to get into cyber?
Regards,
10-27-2021 07:02 AM
Hello,
How is Cortex better/different than other XDR products on the market? Why should a company switch from their current product to Cortex?
Regards,
10-27-2021 08:32 AM
Are there any upcoming discounts for certifications?
10-27-2021 09:09 AM
@OmarDweik wrote:
i have two question
What the Different between Cortex and other EDR with Antivirus Definition ?
What is Content Update ?
One of the single most important differences between Cortex XDR and traditional static/dynamic definitional list protection (i.e. traditional antivirus) is that Cortex XDR provides behavioral analysis on top of WildFire’s file verdict. Contemporary malware, such as MiniDuke, utilize a customized backdoor for each target, written in assembler. Each target receives a unique dropper so traditional methods of analyzing a file based upon others having previously uploaded the same file will be bypassed entirely since every target is unique. In addition to traditional WildFire file verdicts, Cortex XDR uses Behavioral Threat Prevention and Behavioral Indicators of Compromise to detect the sort of activity overwhelmingly used to compromise systems rather than just specific SHA256 hashes or file names.
Content Updates come in the form of new Behavioral Indicator of Compromise rules, new hash updates, agent policy updates and more. An example of a very valuable content update was when Palo Alto pushed out content updates specifically for SolarStorm and the recent Microsoft Exchange compromise.
10-27-2021 09:10 AM
@OtakarKlier wrote:
Hello,
What are some of the training offerings for those with limited/no training budget who are trying to get into cyber?
Regards,
Palo Alto Networks Cybersecurity Academy has a number of free resources available, and with the use of a Beacon account, there are a number of free Digital Learning resources as well.
10-27-2021 09:12 AM
@agalindo wrote:
Are there any upcoming discounts for certifications?
Palo Alto Networks employees receive two free vouchers each year for Pearson certificates. Additionally, there are many certification discounts available from time to time on company emails, and on the Palo Alto Networks LiveCommunity website.
10-27-2021 09:17 AM
@S.Cantwell wrote:
What are the requirements to invited to the XDR201 for CPSP partners?
Is there a chance increase the number of XDR201 classes?
How do we test out of the 201 (meaning, we have many years of experience) that we can earn the associated micro-credentials.
In order to be invited to the XDR201 you need to have passed the XDR101 first.
The number of class offerings is based on the demand. If the classes are all full with a waitlist we will offer additional classes, there are 3 201 XDR classes in between Nov 15-Dec 3. So if you are interested please sign up!
We do not offer a method to test out of the XDR201 class prior to taking the Micro-Credential.
10-27-2021 09:32 AM
=================
One of the single most important differences between Cortex XDR and traditional static/dynamic definitional list protection (i.e.
traditional antivirus) is that Cortex XDR provides behavioral analysis on top of WildFire’s file verdict. Contemporary malware, such as MiniDuke, utilize a customized backdoor for each target, written in assembler. Each target receives a unique dropper so traditional methods of analyzing a file based upon others having previously uploaded the same file will be bypassed entirely since every target is unique. In addition to traditional WildFire file verdicts, Cortex XDR uses Behavioral Threat Prevention and Behavioral Indicators of Compromise to detect the sort of activity overwhelmingly used to compromise systems rather than just specific SHA256 hashes or file names.
My Response...
The Other EDR Vendor they have behavior and legacy With Sandbox verdict so it is more protection.
==================
Content Updates come in the form of new Behavioral Indicator of Compromise rules, new hash updates, agent policy updates and more. An example of a very valuable content update was when Palo Alto pushed out content updates specifically for SolarStorm and the recent Microsoft Exchange compromise.
My response:
Still not clear, as Palo alto they said we don't have update like other vendor (legacy AV) and based to your definition we can consider Content Update same other Antivirus Definition .
By the way at what level Content Update Applicable to Cortex XDR Layers
Prevention,Rule,Analysis & Response or data
10-27-2021 09:50 AM
- Can i delay Cortex 3.0 Services During Startup?
- there is Early Anti Malware Lunching features?
- can i control bandwidth With VM Broker?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
