Cortex Internal Developer Portal

I have used Cortex for more than I worked in Cortex. I have around 2.1 years of experience using Cortex XDR , but currently, I am using Cortex.

My main use case for Cortex is to prepare the chart flow of the main Cortex XDR . In Cortex XDR , we have to alert for our auto-triaging and repetitive tasks, and we use it for triage automatically. We use it for CTI Cyber Threat Intelligence enrichment, such as IP, URL, and IOCs, automatically. It also has reputation checks using VirusTotal , abuse.ch, and others for the purpose of the uses in Cortex XDR . It also includes playbook automation. For example, Cortex has many playbooks for phishing, malware, infection, ransomware, and lateral movement. These playbooks automatically conduct the entire investigation and response. In case management, it stores details, timelines, evidence, and others for easier incident tracking. From the SOC perspective, we have to reduce false positive cases, and it reduces duplicate alerts, allowing our SOC analyst to respond faster. On the other hand, for the use of the EDR, Cortex provides detection behavior, attack prevention, and can always identify file-less and memory-based attacks and UEBA  normally.

An additional point I need to add in Cortex XDR is manual commands during the investigation, such as Cortex war room commands, IP reputation checks, hash look analysis, and endpoint isolation. These help us to conduct a faster investigation. Additionally, we need to create and modify playbooks according to the organization and the needs of the organization's use cases, for example, auto-disabling a user in case of a suspicious login, auto-quarantining an endpoint with malware, and an auto-phishing and investigation workflow. We use Cortex for reporting to generate incident summary reports, post-incident reviews, and RCA documentation. We integrate it with tools such as SIEM , EDR, firewall, email security, web, and others for alert correlation.

The best features of Cortex are automated incident response, playbook automation, cyber threat intelligence, and management. It includes case and incident management, such as incident details, evidence, timelines, and using the dashboard. There is a war room for investigation and to consume alert correlation rules to reduce noise and false positives. It has over 700 integrations. It works with SIEM , EDR, firewall, email security, the cloud environment, and many others. Additionally, it has endpoint detections, behavior analytic UEBA , and machine learning-based detection using ML modules to detect advanced threats. There's a centralized data lake and customized dashboard reports.

I find automation through the playbook to be the most valuable feature I use day-to-day. Playbooks save analyst time. If used for Cortex, it saves the analyst's time with a reduction in false positives. For IOC enrichment, we utilize MTDR, mean time to respond, to resolve incidents faster.

I notice a positive impact since using Cortex. We experience a faster, quicker response. Regarding positive changes, if we have a short positive, we investigate the IP, URL, VirusTotal , and abuse.ch. We use XDR, and it's fast and reliable with no human error. It automatically works to reduce the workload of the SOC analyst, thus decreasing manual work.

There are no other improvements Cortex needs in my opinion.

I have around 2.1 years of experience using Cortex XDR, but currently, I am using Cortex.

Cortex is stable in my experience.

Cortex has good scalability and can handle growth and increased workloads well.

The customer support from Cortex is very good and very useful.

Positive

I did not use a different solution before.

My experience with pricing, setup cost, and licensing is that it is high, but it is better for the SOC environment and for the users.

I notice time saving as a return on investment.

My experience with pricing, setup cost, and licensing is that it is high, but it is better for the SOC environment and for the users.

Before choosing Cortex, we looked at different platforms for automation and chose one after reviewing which one was performing higher in the market, apart from Cortex.

My advice for others looking into using Cortex is that it is very easy to use and very useful for the customer environment, whether it's a public or private one. It is extremely helpful from a SOC perspective, requiring very little time to manage situations, especially during integration, which is necessary. Cortex is very useful and cost-effective, in addition to being very easy to use.

My company has a business relationship with the Cortex vendor for business purposes.

I would rate this product a 7 out of 10.

Positive

I have been using Cortex for my internship at Palo Alto, where I have used Cortex XDR  and Snort tools to detect endpoint and endpoint detection. I have also used similar tools like threat intelligence management to analyze the alerts and suspicious activities. Cortex is the best tool for endpoint detection.

I have used Cortex in a specific scenario where there are certain types of threat intelligence management features. I have used it to verify hashes or domains to identify malicious activity. I also use Cortex XSOAR  and Xnor to trigger playbooks that automate and gather endpoint logs, block malicious processes, and update incident tickets, showcasing end-to-end processes with automation in investigation and reducing the analysis workflow.

I have used Cortex for my internship and afterward in certain projects where I'm working with my college. In those projects, I have been using Cortex for automation through playbooks and using intelligence to prioritize the incidents. I have also practiced to understand the incident lifecycle management from detection to containment.

Cortex is deployed in my organization as part of a hybrid cloud setup, where Cortex XDR  and Xnor components are primarily cloud-hosted by Palo Alto Networks. This arrangement allows for easier management and updates while integrating sensitive data sources with our on-premises systems for security and compliance reasons. The hybrid approach balances the scalability and availability of the cloud while maintaining control and data security with on-premises infrastructure.

The best features Cortex offers in my experience include its capability for detection and investigation, along with several types of threat intelligence management. It includes machine learning to easily analyze data and detect complex threats across endpoints, networks, or clouds. In playbooks, automation handles responding actions such as isolating endpoints or enriching IOCs, along with reducing mean time to detect and mean time to respond. I have used this for my SOC operations environment, discussing it with my college.

Automation and playbooks have helped me significantly. If there is a threat, detecting it used to be a lengthy process. Now, with the advancement in technology, Cortex Xnor's playbooks predefine the workflow of the automation, such as response processes, alert triggering, and enriching the context. These automations collect relevant indicators such as hashes, IP addresses, or domains efficiently and can detect and block malicious attacks with firewalls. It is very useful for eliminating workload of human errors, speeding responses for next-generation operations. Playbooks are customizable with dynamic analysis that align with organizational policies.

I think Cortex is the best tool, but there are a few points that could be added to improve it. For instance, enhancing UI simplicity and playbook flexibility are areas that could benefit from more low-code automation options for smoother integrations. AI-based alert prioritization features could enhance efficiency for SOC units.

Cortex is a very good and accurate tool, and if some other tools could be integrated, such as third-party tools including Splunk, ServiceNow , and Microsoft, it would significantly enhance usability. Improving reporting and dashboard customization, along with the addition of real-time and exportable reports, would help SOC teams greatly. APIs should be efficient, coupled with simpler low-code notebooks for customizing smart AI-based incident prioritization systems.

While using Cortex, I noticed some aspects that could be improved, such as increasing the synchronization speed between XDR  and Xnor. Although the synchronization is fast, it could be enhanced to generate new alerts more quickly. There could also be more granular role-based access control for better permission management, along with built-in playbook templates for common incident types such as phishing, allowing users to deploy automations more swiftly.

I haven't used any tools before Cortex during my internship. This was my first experience with an endpoint detection tool, and I find it to be the best tool I have encountered.

In my experience, I have not faced any issues with Cortex; it functions seamlessly. There are no major downtimes reported, and the system remains reliable and efficient, with only minor sync delays under high data loads.

Cortex remains fast and responsive, even with increasing data and alerts. Although there is a slight delay during peak load, the overall performance is stable and efficient.

Cortex can handle data loads effectively, showing its scalability.

As an intern, I manage my tasks independently, utilizing the extensive resources available online to learn how to use Cortex without needing customer support.

Positive

I haven't used any tools before Cortex during my internship. This was my first experience with an endpoint detection tool, and I find it to be the best tool I have encountered.

Cortex is the only tool provided to me throughout my internship, and I believe it is an excellent choice for endpoint detection and automation. I have enjoyed a great user experience with it, making it a standout tool.

Before using Cortex, it's essential to research its features and capabilities. This knowledge aids users in becoming proficient. I advise new users to start small with playbooks, focus on data quality for XDRs, and plan integrations carefully for improved response speed and efficiency.

I believe Cortex is a great tool that everyone working in cybersecurity should try. Those who use it will fall in love with it due to its automation capabilities and the numerous helpful features it offers. I would rate this product a nine out of ten.

Positive

Positive