About yle

Modern organizations have no defined perimeter anymore. Your attack surface spans on-premise, in the cloud, and across your supply chain, and it is constantly changing as internet-connected assets are created, moved, or configurations changed. Manually maintaining an accurate and up-to-date inventory of these internet-connected assets is an impossible task, but luckily you don’t have to do it alone.   Cortex Xpanse by Palo Alto Networks protects the world's largest organizations by discovering and monitoring every asset you have connected to the internet and provides complete visibility into everything you own, including IP addresses, domains, certificates, and cloud infrastructure. Xpanse gathers data from DNS records, domain registrars, business registration databases, and dozens of other data sources to not only comprehensively discover, but also accurately identify every single one of your internet-connected assets. This data is used to create an intelligent, continuously updated inventory of assets unique to each organization, complete with potential exposures and attribution information. With this wealth of knowledge and information, you can easily identify, prioritize, and route issues to the relevant stakeholders for remediation. And you can also build resilient security processes to automate actions regarding risky services and exposures with Cortex XSOAR’s automation capabilities.   Cortex Xpanse and XSOAR work together to enable automated attack surface management. Xpanse’s global internet collection and attribution platform continuously discovers and monitors your organization’s attack surface for exposed internet assets and risky services. When integrated with Cortex XSOAR, the two products can help you discover and manage shadow IT assets that are exposing confidential services to the internet and automate the entire process of detection and risk mitigation to drastically reduce your attack surface.   What is Cortex Xpanse and Attack Surface Management?   Cortex Xpanse brings a unique level of visibility to security through the continuous scanning of exposed assets. Xpanse scans the entire internet for publicly exposed assets allowing you to discover, evaluate and mitigate cyber attack surface risks. You can also evaluate supplier risk and assess the security of acquired companies with Xpanse Link.   Because Xpanse provides a complete, accurate and continuously updated inventory of all global internet-facing assets, this ensures that your security operations team has no exposure to blind spots or assets that the IT staff may be unaware of or not monitoring. This includes exposure categories such as:   Remote access service Insecure file sharing or exchanging services Unpatched systems vulnerable to public exploit and end-of-life (EOL) systems IT admin system portals Sensitive business operation applications Unencrypted logins and text protocols Directly exposed Internet of Things (IoT) devices Weak and insecure/deprecated cryptography Exposed development infrastructure Insecure or abandoned marketing portals   What does the Cortex Xpanse Content Pack do?   Palo Alto Networks Cortex product suite already provides enterprise-wide visibility, prevention, detection and response capabilities, and Xpanse extends these capabilities across exposed and untracked externally-facing assets. The Palo Alto Networks Cortex Xpanse content pack enables an automated approach to attack surface management and risk mitigation by operationalizing Xpanse’s findings to drastically reduce an enterprise’s attack surface.   The integrations included in the pack enable fetching and mirroring of Xpanse Issues into Cortex XSOAR incidents, and ingestion of indicators (IPs, domains, and certificates) referring to the corporate network perimeter as discovered by Xpanse.   Through a powerful set of playbooks, analysts can correlate the discovered information with data provided from internal security systems (Palo Alto Networks Cortex Data Lake, Prisma Cloud, and Panorama, Active Directory, Splunk SIEM, etc.) to pinpoint asset owners and automate remediation.   Automated Attack Surface Management   What does this content pack do?   Provides the Cortex Xpanse integration, which allows XSOAR to collect Xpanse Issues and bi-directionally mirror them. Several commands are available to search, tag, and update issues and assets in Xpanse. The integration also supports the services API. Provides a feed integration named Xpanse Expander Feed, which is compatible with the Cortex XSOAR Threat Intel Management capabilities to retrieve and store discovered assets (IPs, IP ranges, domains, certificates) in Cortex XSOAR for analysis and correlation. Provides an Xpanse Issue incident type with dedicated fields and layouts. Provides a rich set of playbooks and sub-playbooks that handle the investigation and remediation of Xpanse Issues. Provides dashboards that display the network perimeter as discovered by Xpanse and the status of Xpanse Issues.     Automated Attack Surface Management   How do I use this pack?   Configure the Xpanse integration to ingest Xpanse issues and data. Select “Incident - Attribution Only” as the default playbook to perform enrichment only (no remediation). This pack also includes a generic playbook called Xpanse Incident Handling - Generic. In order to use it, configure the instance and choose Xpanse Issue - Generic as the incident type.   Handle Xpanse Incident - Remediation Playbook     For more information on the Cortex Xpanse Attack Surface Management Content Pack, visit our   Cortex XSOAR Developer Docs For more details on how you can maximize the entire Cortex product line, check out the blog “Building a Virtual SOC with the Cortex Suite of Products”.   Don’t have Cortex XSOAR?   Download our free   Community Edition   today   to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   Please Suggest Other Ideas or Vote!   If you like these ideas or would like to suggest other ideas, please collaborate with us through the Cortex XSOAR Aha page:   https://xsoar.ideas.aha.io/ideas   ... View more

  When responding to a security incident, triage, analysis, enrichment and remediation all can be time consuming and error prone processes, especially when responding and managing these attacks requires security teams to reconcile data from multiple sources. Often, by doing so, valuable time is lost shuttling between screens and executing repeatable tasks while an attack continues to manifest.    Today we’ll look at how SOC teams are able to utilize the best of both XDR’s extended endpoint threat detection and response with XSOAR’s workflow automation, orchestration and threat intelligence capabilities to become more effective using the  Palo Alto Networks Cortex XDR — Investigation and Response content pack .    Automating XDR Incident Response   Cortex XDR is a detection and response platform that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. By standardizing the XDR incident response and automating response with the  Cortex XDR — Investigation and Response content pack , Cortex XSOAR decreases the mean time to detect by automating the collection of enrichment data, and providing centralized tracking. The pack includes out-of-the-box Cortex XDR incident type views with incident fields and layouts to aid analyst investigations, which are all easily customizable to suit the needs of each unique organization.     Default Cortex XDR layout provided by the content pack   What Does the Cortex XDR - Investigation and Response Content Pack Do?   This content pack contains the Palo Alto Networks Cortex XDR Investigation and Response integration that enables direct execution of Cortex XDR actions within Cortex XSOAR. It also performs bidirectional incident updates between Cortex XDR and Cortex XSOAR. Plus, it enables the following workflows: Device Control Violations  — Fetch device control violations and enrich data from XDR incidents and communicate with the user to determine the reason the device was connected. XDR Incident Handling  — Compare similar incidents in Palo Alto Networks Cortex XDR and Cortex XSOAR, identify duplicate incidents, and update the incidents appropriately using the  Cortex XDR Incident Handling v3  playbook ( as seen in image 2 below ). Threat Hunting And Detection  — Extract IOCs from the investigation and run them across the organization to check if there are any other compromised accounts or endpoints with the same information that was detected in this alert. AWS User Access Investigation  — Investigates and responds to Cortex XDR Cloud alerts where an AWS user's access key is used suspiciously to access the cloud environment. Enhanced Threat Detection with IOC Synchronization  — Operationalize threat intelligence feeds and ensure the detection and response controls are leveraging the threat Intel feeds to push IOCs to XDR to enable better threat detection.   For more details on all the different playbooks options available within the XDR and XSOAR content pack, check out the blog “XDR + XSOAR: A Dynamic Duo”.   The playbooks included in this pack help you save time and keep your incidents in sync. They also help automate repetitive tasks associated with Cortex XDR incidents, such as:   Syncs and updates Cortex XDR incidents. Triggers a sub-playbook to handle each alert by type. Extracts and enriches all relevant indicators from the source alert. Hunts for related IOCs. Calculates the severity of the incident. Interacts with the analyst to choose a remediation path or close the incident as a false positive based on the gathered information and incident severity. Remediates the incident by blocking malicious indicators and isolating infected endpoints.   It is without a doubt that the Cortex portfolio of products is designed to make the life of a security analyst better, faster and more efficient when it comes to detecting and responding to today’s security threats. The beautiful thing about the Cortex family of products is the ability to use each platform in conjunction with one another for maximum results.    Watch the video below for a detailed overview of the XDR and XSOAR Integration. For more information on the Cortex XDR Content Pack, visit our  Cortex XSOAR Developer Docs.         Don’t have Cortex XSOAR?  Download our free   Community Edition   today  to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.      Please Suggest Other Ideas or Vote! If you like these ideas or would like to suggest other ideas, please collaborate with us through the Cortex XSOAR Aha page.   ... View more