Palo Alto Networks Cortex XDR

Formerly Traps

Traps/now Cortex XDR was being used to provide endpoint protection for our servers and desktops. Traps/Cortex XDR was being used organization wide.

Palo Alto Networks Cortex XDR is used for our in-house as well as roaming users, and we have procured around 200 licenses. With Palo Alto Networks Cortex XDR, we are enabling security controls and also getting insights and deep visibility on our users' suspicious activities and behaviors and securing them from advanced attacks like file-less malware, ransomware, etc.

Palo Alto Cortex XDR has excellent features which strengthen Security for Endpoint, Cloud and Firewall that can be integrated into a single solution. It has the capability for Digital Forensics and Ransomware Protection as well.

The trap was easy to install and worked well with the Palo Alto Suite overall. Upgrades are seamless because everything is in the cloud. We use traps on all of our devices, including laptops and virtual desktops. They did this to guard against malware, zero-day exploits, and APT attacks. This gives us the ability to triage/investigate right from the home page. It can disclose Gray ware and other serious malware and exploit attempts that Windows Defender misses. Palo Alto Networks Traps can also prevent the execution of malware that does not require a file to be downloaded. We’ll see in the CortexXDR product that Palo Alto Networks has added Traps functionality.

XDR is being used as an Endpoint Response tool. As an EDR we are able to identify events and logs across multiple devices. The nodes on the network display a variety of information that help analyst understand behaviors in the environment. XDR address the problem of security analysts being able to discover, detect, and respond events or incidents involving hosts on the network.

Palo Alto Networks Traps is used across the whole organization.

It is important to note that the functionality of Palo Alto Network Traps is being subsumed into the larger CortexXDR product. Traps has been a good way for our organization to implement advanced anti-malware detection and prevention with a low false-positive rate and a minimum of user annoyance. It is able to catch things that are missed by Windows Defender, both grayware and more serious malware, and exploit attempts. Palo Alto Network Traps can even prevent file-less malware from running.

Traps are used by all of the endpoints (notebook & VDI) in our organization. This is done to mitigate the risk from malware attack, zero day attack and APT. Previously we utilized a typical anti-virus agent for protection from known malware. However since Q1 last year and based on the threat trends, we discovered it's not enough just to rely on the known malware/traditional anti-virus solution.

We had previously used a local server-based agent before Traps. We have a Palo Alto firewall with subscriptions to URL filtering, Wildfire, and threat prevention so the systems were separated. Traps was an incredibly easy install that integrates with the rest of the Palo Alto Suite. I no longer have to whitelist our old agent and update that server. Everything is cloud-based so updates are seamless.

Traps was purchased as a response to a virus outbreak that kept cropping up due to still infected systems popping up days or weeks after we deemed the environment clean. It's being used across the entire organization currently and helped us identify that threat, quarantine it and also helps isolate future malware from spreading across the network.

We recently replaced Kaspersky with Traps. Great next gen product! Easy to use, easy to manage and fantastic protection. It has saved us from a few users who like to on spam already and we were able to get our whitelist fleshed out in no time for those pesky one-off and in-house built apps.

Traps is being used with Palo Alto Wildfire and host AV to add layers of protection to hosts to assist in finding unknown and 0 day malware. Traps is also used on servers to help provide advanced malware protection. Traps is in pilot across the server infrastructure and production for user workstations. We have evaluated several advanced endpoint protection applications and because of Wildfire integration, it was the product chosen for deployment.