eXtended Threat Hunting (XTH) Module

[SeanDeHarris]

Hi team,

Got a renewal quotation with new XTH module.

Heard eXtended Threat Hunting (XTH) Module is about query the raw data for threat hunting.

Still not so sure what is the new module is used for?

What is the use case to purchase this lic in addition to XDR Pro.

Without the XTH, what is limited when comparing with XTH lic on?

Regards,

SDG

[neelrohit]

Hi @SeanDeHarris ,

The XTH module will ensure ingestion of additional data metrics which can be used for detailed investigation events. This module will ensure you have the agent collecting all the necessary data required for threat hunting events related to process, network and user entity based activities that can be collectively leveraged for effective threat hunting events. 

It also ensures to get high fidelity alerts on basis of UEBA data which is not part of the normal XDR Pro agent. Also, that essentially makes you get some extra detectors that we have with Pro+ XTH.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query

[afurze]

Hi SeanDeHarris,

Just to add some additional color on this, you will not miss any attacks or decrease your protection capabilities by not purchasing the new XTH module.  The vast majority of analytics alerts will still work, and those that do not are being actively evaluated by our research and product teams to determine if any changes can be made to ensure they work with the data uploaded by the new base Pro EP offering.

The goal of splitting out some EDR data collection is to keep our existing protection and detection capabilities largely intact while reducing the bandwidth consumption for customers that don't want or need the detailed log collection for threat hunting.  You will, of course, get all relevant data uploaded when an alert is triggered on the agent, but the real-time data uploading is more limited otherwise.  

I would recommend you reach out to your account team for detailed information on what events are and are not collected without the XTH license, and to have an additional discussion around how we are continuing to provide the same great detection and response capabilities regardless of your licensing.

[Joe_Botelho]

Hello, where can I "see" this module? Are there additional steps or actions that need to be taken to make sure this add-on is working as expected? If anyone can provide a link to an article providing more information, that would be greatly appreciated. 

[bkedmunds]

I have the same issue, there is not much documentation on this module other than the analytics alert reference guide, however I don't see any of these alerts in my tenant. 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference/XDR-Agent-eXtended-T... 

[neelrohit]

Hi @bkedmunds ,

Maybe this doc helps. It outlines the type of logs which require XTH module for data collection and enhanced telemetry:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Da...

[bkedmunds]

Thank you @neelrohit this is exactly what I was looking for.