About mperlman

Hi Christowner,   You can leverage the existing pre-built in query builder to query and do threat hunting for different C2 activities like attackers leveraging regular connections to hide their channels or attackers using benign domains or files, Cortex XDR have multiple methods to detect attackers from pre-built in ML algorithms to rules or signatures and you can also create your own different queries for detection.   If you have a specific type of attack you would like to know feel free to send me PM or post it here.    Menachem.     ... View more

There are many ways we can detect C2 (beaconing) activities using the Cortex XDR, we can do it by looking on the endpoint and or the network data, take a look here for a few examples of the detections we have in the product https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference.html  In addition for that we have many more ways to detect using C2 as an example protecting the endpoint.   Menachem.  ... View more

Cortex XDR 2.0 is already available at the same regions US and EMEA like we had before for Cortex 1.0.    Menachem.  ... View more