Cortex XDR - How We Distinguish Ourselves From a SIEM Solution

[nhussaini]

When running a SIEM, you need to have a huge team of many Analysts Level 1, Level 2, Level 3… Escalations to lateral teams (sometimes to take actions such as isolating endpoints/servers, gathering/deleting suspicious files, etc). It is laborious and time consuming to perform simple actions, like creating an alert. 

Read Cortex XDR - How We Distinguish Ourselves From a SIEM Solution to learn more on this topic from our experts!

Palo Alto Networks Contributors:

Luis Escobar, Cortex Customer Success Architect 

Maor Hojberg, Technical Marketing Engineer 

Cortex XDR 

[SStonebraker]

Cortex XDR lacks a unified data model which impedes the ability to rapidly perform useful searches across disparate datasets.  Are there plans to address that gap?

[eluis]

Hi SStonebraker, 

if you mean that Cortex XDR doesn't have a dataset that holds all the datasets, that is correct. But so far we dont need that because in Cortex XDR, you can query and search with XQL any dataset and a combination of them in a very good response time. Creating a dataset of datasets will screw the searches response and so far there is no point to do so.

On top of that we have Cortex XDR Collectors that can collect data/logs from a miriad of sources ftp, linux system logs, windows, webservers of many flavors (IIS, apache, nginx), Fw, you name it. Once that those logs are uploaded in our Cortex management console in the cloud you can perform XQL queries on them. 

Additionally you can save the XQL queries in a public area so you and all your work mates can reuse them without reinventing the wheel. 

You can also save the queries as correlation rules and set the timing to launch them... 

As a source for XQL query center documentation, please visit the link: 

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

From there you can also jump to other very good XQL documentation sources.

Hope this helped.

Kind Regards, 

Luis 
 

[eumbach]

PAN Cortex XDR isn't a SIEM!

Also PAN check out Cortex XDR 3.0 now with correlation searches and the ability to ingest data from anywhere!!! 

😄