SecOps ProDemo

Enhanced Application Logs (EAL) is the sensor/telemetry source that supplies the analytics engine with high-fidelity network context, including DNS queries, HTTP header (User-Agent) fields, and DHCP information generated by the NGFW. Palo Alto documentation and the analytics-sensors material state that enhanced application logs are designed to increase visibility by capturing DNS, DHCP, and URL/HTTP data that basic traffic logs miss. The Pathfinder data collector (C) is different: it interrogates unmanaged hosts/endpoints for risky software, not DNS/HTTP/DHCP network telemetry. Directory Sync (B) provides identity/AD data, and Windows Event Collector logs (A) are host event logs.

Identity Analytics analyzes authentication and identity activity for abnormal behavior and can alert on suspicious logins, such as a successful login following several failed attempts.

Cortex XDR extends investigation and correlation beyond endpoint telemetry by ingesting and normalizing relevant network, cloud, and identity-source data. This enables analysts to connect activity across NGFW logs, cloud workloads, and IdP-reported account compromise in one investigation.

Cortex XSIAM centralizes and normalizes security telemetry from endpoints, firewalls and other network devices, cloud audit sources, identity systems, and third-party tools. Its onboarding guidance specifically covers next-generation firewall data, cloud audit logs, and identity/user data, making it the appropriate platform for full-ecosystem threat visibility rather than endpoint-focused protection.

A large upload of user data from an internal file server to a public website may represent data exfiltration. Exposure of user information can have severe confidentiality, regulatory, financial, and reputational effects, making it the highest-priority incident.

Cortex Marketplace is the centralized XSOAR portal for discovering, downloading, installing, updating, contributing, and managing content packs. These curated packs bundle security-orchestration assets such as integrations, playbooks, dashboards, scripts, and their dependencies.

Incident types classify events ingested through integrations or the REST API. They can be associated with dedicated playbooks, including automatic execution when an event is ingested, and they support customized layouts and incident-type-specific SLA parameters.

The Analytics Engine analyzes telemetry for anomalous behavior, including composite patterns that diverge from established baselines, and raises alerts when it detects that behavior. Palo Alto Networks documentation states that Cortex XDR’s analytics engine can analyze logs and raise alerts on anomalous behavior.

Cold storage is intended for lower-cost, long-term retention and has limited search capabilities. Querying it requires data to be rewarmed into a temporary hot-storage cache, which makes retrieval slower than querying fully searchable hot storage.

The Cortex XDR Responder role provides the operational permissions needed to investigate alerts and take endpoint remediation actions, including terminating malicious processes and isolating compromised hosts, without granting full tenant-settings administration.

XQL is Cortex XDR’s query language for investigating and correlating endpoint telemetry and other collected security data. Palo Alto Networks documentation identifies Cortex XDR queries as XQL queries.

In Cortex XSOAR, incoming events are classified and mapped to an incident type. An incident type can have a dedicated default playbook configured to run automatically when the event is ingested, enabling automated response actions.

Cortex XSOAR provides out-of-the-box indicator types including IP Address, Domain, URL, and File; file indicators are used for file hashes. Palo Alto Networks documents these as built-in indicator types.

Cortex XDR receives on-premises firewall Syslog through the Syslog Collector applet deployed on a Broker VM in the local network. The collector accepts Syslog data from external sources, including next-generation firewalls, and forwards it to Cortex XDR.

The Cortex XSOAR War Room supports running security playbooks, scripts, and commands, including real-time security actions through its command-line interface.

Data Model Rules require View/Edit RBAC permission for Data Management. The Account Admin has the same View/Edit tenant permissions as the Instance Administrator, providing both roles access to Data Model Rules.

Scope-Based Access Control (SBAC) restricts a user’s access to defined endpoint groups or endpoint tags, limiting the user to the endpoints and related resources within that scope. RBAC grants permissions to product functions, while SBAC narrows those permissions to the relevant endpoint data.

Log correlation automatically identifies and connects related events across data sources, enabling centralized analysis without manually comparing separate sensor logs.

Data protection supports compliance with privacy and other regulatory requirements by ensuring that sensitive data is appropriately safeguarded.

A Security Information and Event Management (SIEM) platform collects and centralizes log and event data from many sources, enabling compliance reporting, security dashboards, investigation, correlation, and threat hunting.

The triage specialist performs the initial review of incoming alerts, including low-severity alerts, to validate, prioritize, and determine whether escalation is necessary.

MITRE ATT&CK classifies Remote Services: Remote Desktop Protocol (T1021.001) under Lateral Movement. Using stolen credentials to establish an interactive RDP session on a domain controller moves the adversary from a compromised workstation to another system in the network.

The War Room supports running integration commands directly during an incident investigation and serves as the incident’s audit trail for manual and automated actions. It therefore enables IP enrichment in the incident workspace while preserving the command activity in the incident record.

Threat hunting should establish the scope of a malicious artifact by searching its SHA256 hash across endpoints. This identifies other hosts on which the same file may exist or have executed, providing evidence needed to assess the incident and guide containment. Cortex XDR hunt collections are intended to find which endpoints executed a piece of malware, and its file-search capability supports SHA256 hashes.