HIPS and Host Firewall

[MohanKumar1]

I would like to know whether Cortex XDR has Host Intrusion Prevention and Host Firewall capability. If yes, what is the difference and how to enable.

[Casey69]

I am looking for the same. njmcdirect

[bbarmanroy]

@MohanKumar1 @Casey69 HIPS stands for Host Intrusion Prevention System. Cortex XDR is an EDR solution, and I assume what you're looking for is explained in detail here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-...

Yes, XDR supports Host Firewall capabilities. You can refer to this documentation here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/hardened-...

[MohanKumar1]

@bbarmanroy 
Thanks for the information. It is confirmed HIPS is not support or not the module available in Cortex XDR as an endpoint security. Or let me know if I am wrong.

Host Firewall is available in EDR.

[bbarmanroy]

@MohanKumar1 Cortex XDR certainly covers the capabilities of a traditional HIPS, and much more. What features of HIPS are you looking for?

[MohanKumar1]

Does the default XDR update IPS signatures automatically. If yes, How do we check / ensure.

[bbarmanroy · Accepted solution]

Hi @MohanKumar1 the logical equivalent of that would be the "XDR Content Updates", commonly referred to as CU's. You can check the corresponding CU's for an agent via the Endpoint Administration page.

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/about-con...

You can modify the CU updates based on your Agent settings (see brief explanation here).

[MohanKumar1]

Thanks, this was the clarification I was looking.😊

[eluis]

Hi MohanKumar1, 

xdr agent can perform packet inspection in its own fw (dont take it as a full featured FW as our NGFW) in the link that my colleague @bbarmanroy sent you can see at the end of the features list the packet inspection. 

Also realize that we can gather your network traffic and analyse it on the cloud not just with signatures, better than that we perform ML and detect malicious traffic from new attacks that will not be detected by standard signatured based IDS. All this signatures and intelligence is maintained by PANW, you dont need to worry about them. 

Please check out these two docs: 

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-...

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-release-notes/set-up-network-analysis...

Hope this helps also.

KR, 

Luis