Hi AndreFOTSO,
The capabilities of Cortex XDR are heavily dependent on the types of data you provide and whether or not the agent is deployed. Since you have specifically called out not deploying the agent I'll talk about using Cortex XDR to provide alerting from 3rd party data sources. If you have Palo Alto Networks Next Generation Firewalls (NGFW) you can ingest these logs and our analytics engine can build anomaly based detections based on this data. Additional supported data sources can also build additional detections from Windows Event Logs, Microsoft 365 audit logs, Azure/AWS/GCP Audit logs, Okta, and others. You can also build custom correlations against these datasets to surface alerts that the platforms themselves surface (for example, IdP alerts from Azure AD) or create your own alerts.
As to your question about running a 3rd party endpoint protection solution and integrating with Cortex XDR, we simply do not receive the necessary telemetry from other EDRs to provide detection and response capabilities, so you won't get any OOTB detections or alerts based on this data. You will also have to rely on the management platforms for your 3rd party solution to perform any response actions like endpoint isolation, agent scripts, live terminal, etc, these actions cannot be performed from within Cortex XDR without the XDR agent present on the endpoint.
Make no mistake, Cortex XDR can be deployed without the XDR agent and provide detection capabilities as well as an investigation and threat hunting platform for your 3rd party logs and other Palo Alto Networks solutions like NGFW and Prisma Access, but if you are wanting to use it for endpoint detection and response, you will see little value without deploying the Cortex XDR agent.
... View more
