Supercharge your investigations with intelligent incident scoring, enhanced search visualization and support for the richest set of data sources ever.
Today, we released Cortex XDR 2.7 and Cortex XDR Agent 7.3, which, together, deliver a huge set of highly anticipated features that speed up investigations and boost the defenses of the Cortex XDR endpoint agent. These new capabilities not only block fast-moving endpoint attacks and help you reduce the mean-time-to-respond (MTTR) to incidents, they help deliver, in conjunction with Cortex XSOAR, an integrated platform for all your SecOps needs.
Incident Scoring Lets You Focus on What Matters
Security teams face today an endless deluge of alerts – to the tune of 11,000 alerts per week on average. Our innovative Incident Management feature, introduced in 2019, alleviates alert fatigue by grouping related alerts from multiple data sources into incidents, cutting the number of individual events to review by 98%.
In Cortex XDR 2.7, we’ve taken Incident Management to the next level with the introduction of incident scoring. A highly sought-out feature for customers, incident scoring lets you rank and prioritize high-risk incidents to swiftly zero in on the most critical threats. You can create incident scores based on over a dozen alert attributes, including the users or hosts in an alert. To simplify rule creation, you can upload a list of high-priority assets. With incident scoring, you can quickly home in on incidents that involve sensitive servers, for example, or prioritize attacks targeting your executive leadership team.
Flexible Insights Supercharge Your Investigations
Collecting the right data is the first step for effective detection and response. But all too often, SOC analysts end up drowning in the expansive data lakes they’ve built. To investigate threats, analysts need to quickly find the answers they’re looking for and decipher investigative clues in a snap by reviewing charts rather than scrolling through neverending tables. Reducing incident response time requires better search insights and more flexible queries.
With Cortex XDR 2.7, the search for exceptional search is over. To better visualize search results, Cortex XDR automatically generates graphical histograms for every field in a query. New search options let you analyze more types of data, while query language enhancements, such as optional case-insensitive searches, let you hunt down threats with ease.
You can now display search results using a wide array of charts and visualization options including:
- Pie charts.
- Area graphs.
- Bubble graphs.
- Scatter graphs.
- Gauge graphs.
- Single value totals and tables, in standard text, JSON and tree view formats.
A new widget library allows you to save your personalized charts and use them in dashboards, reports and search results. The widget library is your one-stop shop for all customized charts and graphs.
Visibility Across Even More Data Sources Eliminates Blind Spots
Two years ago, we launched the industry’s first extended detection and response platform to empower organizations to hunt down and eliminate threats across siloed data sources. In Cortex XDR 2.7, we are continuing to fulfill this promise by adding new data sources and log formats that expand our visibility, allowing your team to protect an unprecedented number of assets and stop more threats than ever.
Cortex XDR has added support for new log formats, including LEEF and Elastic Filebeat, and can ingest additional types of log files, including AWS® CloudTrail, Amazon CloudWatch, Google Kubernetes® Engine and PingFederate®.
Endpoint Agent Enhancements
To keep you fully protected from modern endpoint attacks, we have introduced the Cortex XDR agent 7.3. This release improves feature parity across operating systems and adds new defenses to block vulnerable drivers and stop attacks originating from malicious remote hosts. Key enhancements include:
- Expanded response options for macOS® endpoints, including Search and Destroy and network isolation, let you instantly stop the spread of malware and swiftly contain threats.
- Peer-to-peer updates for macOS and Linux allow you to reduce internet bandwidth usage by retrieving updates from other endpoints, such as the existing peer-to-peer content distribution for Windows endpoints.
- Device Control for virtual desktops enables you to granularly control USB access to virtual desktop infrastructure (VDI) clients and prevent data loss and threats from unsanctioned USB devices.
For a complete list of new features, check out the Cortex XDR release notes. You can also read about our latest updates to neutralize SolarStorm, variants and imitators, as part of our unceasing effort to protect customers from the latest threats.
By Palo Alto Networks Source Link
