About kcross

Cortex XDR can generate the accuracy levels advertised after three weeks of automatically profiling an organization’s network. Some Cortex XDR detectors will begin firing during the first week, others within the second week because they require different baselines or time profiles. Between the third and fourth weeks, all detectors will be operational, and customers will be able review their behavioral analytics results. Plus, customers will have had the opportunity to white list alerts that they do not want to see by that time. ... View more

A Palo Alto Networks next-generation firewall must capture network traffic sent between endpoints and data center servers.   To monitor internal network traffic, customers may:  Use existing inline Next-Generation Firewalls that monitor internal network traffic as sensors to collect network metadata for Logging Service and Cortex XDR (formerly Magnifier). Deploy a Next-Generation Firewall in inline L3 mode.  This deployment will also offer the added benefit of improved network security because of internal segmentation, threat prevention, and visibility. Deploy another Next-Generation Firewall inline, in VWire mode.  This way the Next-Generation Firewall supports multiple VWire interfaces, so the customer’s network does not need to be re-architected, but it will require downtime. Deploy another Next-Generation Firewall with multiple interfaces configured in TAP or SPAN ports or Network Packet Brokers to send the traffic to these Next-Generation Firewalls. Configure new or unused interfaces on a perimeter Next-Generation Firewall to receive collected traffic in TAP mode, if the firewall has extra interfaces and can handle the additional traffic. The customer would use a Network Packet Broker to aggregate the east-west traffic to the perimeter firewall. ... View more

No, Pathfinder uses an agentless endpoint analysis service, running its own code on suspicious endpoints to collect information about running processes on the endpoint and determine if the processes are malware or greyware. ... View more

Cortex XDR (formerly Magnifier) is well suited to stopping Internet of Things (IoT) threats. IoT devices can be exploited to become a point of entry for a network attacker or to launch different kind of attacks like DDoS attacks. Industry researchers have demonstrated successful attacks on cars, thermostats, video cameras and televisions. Many of these devices are not well protected and organizations cannot easily install antivirus or intrusion detection agents on them. Because Cortex XDR can detect network behaviors indicative of attack, Cortex XDR can identify command and control and lateral movement originating from or to IoT devices ... View more

AutoFocus complements Cortex XDR (formerly Magnifier). AutoFocus provides contextual threat intelligence to accelerate investigations. Security analysts can look up information about suspicious files, URLs, or IP addresses with AutoFocus. Plus, AutoFocus can alert customers’ security teams about high-priority events, enabling them to take swift action to mitigate attacks. It is a resource for threat hunters to get additional information about incidents that they are already investigating.     Cortex XDR, in contrast, is designed to detect attacks—especially command and control, lateral movement, exfiltration, and compromised endpoints—by analyzing network activity. Cortex XDR also helps security analysts confirm threats with Pathfinder endpoint analysis.  Although both products help organizations investigate threats, they provide different types of data—threat intelligence information with AutoFocus versus network security alerts with Cortex XDR—and are designed for different stages in incident response processes. ... View more