Palo Alto Networks Cortex XDR The Next-Gen Security Backbone for Modern Enterprises
Use Cases and Deployment Scope
Palo Alto Networks Cortex XDR is used in our organization to gain the better visibility in terms of networks, cloud, endpoint. it provide the single pane of glass visibility where user don't have to go tab by tab for multiple tool, rather than that they get the visibility from a single console. It reduce the mean time to detect and respond. Before we are facing the challenge that in a single day analyst are getting more than 500 alerts. The analyst not able to identicy which one is false positive and which one true positive this bring that a single analyst is busy on a single incident for 1-2 hour. Meanwhile the most important and priority aleert get breached. So Palo Alto Networks Cortex XDR bring the feature of case which bring same type of incidents into a single case which reduce the alert noise as well as analyst do not have to focus on a single alert rather than that they investigate a case and that investigation can solve 15 or more alerts from a single case. It also provides the RBAC which help admin to provide the necessary permission to analyst, admin, investigator etc. Previously if we have to get the visibility of application, autoruns, registry etc then we have to check individual endpoint on by one but from Palo Alto Networks Cortex XDR host insights model we get all this type of visibility from a single console. its also providing the Vulnerability management platform which help admin to get visibility of vulnerability of assets, OS even of application. It is the one solution which provides GUI based live terminal where admin can get the visibility of drive, folders, file and can also download it over from console of specific endpoint. Even we can also run python code, script and also get visibility of task manager and we can end process from task manager from Live terminal only. So we do not need to go one by one on every endpoint rather we can manage and get visibility of all this thing from a single console.
Pros
- GUI based live terminal which provides visibility of task manager, Drive, folder, file. Even we can execute python code, command in PowerShell and cmd.
- Incident / alert grouping into a Case. It minimize the mean time to respond. before analyst focus on every alert and some of them great breached and lasty they find its false positive. But with case they can focus on multiple alert which is grouped in a single case based on behavioural, hostname, Ip, incident type. this reduce time to respond and identify the alert whether its false positive or true positive.
- Vulnerability Management - Now organization can get visibility of Vulnerability over their assets, OS, application which is running on endpoint. even they get remediation suggestion and what CVE is getting over that vulnerability.
- Automatic Sandbox analysis- on every detection or prevention done by Palo Alto Networks Cortex XDR agent you will get analysis report for it over the console from the Wildfire. It provides the sandbox and analysis report so that admin or analyst can get better visibility what it can impact on their organization and how.
Cons
- Within a short time period if same time of malware is executing again and again it provides the timeline of first execution but as a analyst if we think we need all the time whether it should be in second.
- Malware Title for alerts- It provides the malware name as wildfire malware rather than it can provide the exact malware name which can help analyst to identify the alert based on name only then they can go for deep analysis.
- ZIP file Quarantine- Now Palo Alto Networks Cortex XDR is blocking execution of malware but it should quarantine the ZIP file also but now its quarantining the file file after extracting from Zip and when we try to execute it. No ZIP file quarantine is available now.
Likelihood to Recommend
It help organization to gain visibility over all Network, Cloud, Endpoint. Also it help to correlate the events from multiple aspects and on the basics of it it provide the visibility and incidents over console. It reduce the noise of alert so that analyst can focus on priory alert which is actual need attention and can affect organization. It map the alert and incidents with Mitre ATT&CK which gives better analysis that how the incident is behaving in our environment and what types of tactics and techniques its using. So we have a scenario that we have to use multiple product and solution for network, cloud and endpoint. If something or malware we find we have to go every tool one by one to investigate this, we are not getting the better visibility and it also taking much time. But after Palo Alto Networks Cortex XDR it make easy to correlate the data from multiple verdict and it reduce time also. now we get visibility from a single console rather going tab and tab to see and find the aspects. Even we can take action over it from the console only rather going on individual endpoints.
