Agent-based protection - Protect your workloads from various types of injection attacks, exploitation attempts, known vulnerabilities, automated tools, and more. - Administrator Guide - Cortex CLOUD

Advanced Threat Protection

Advanced Threat Protection (ATP) is a comprehensive security feature designed to detect, prevent, and respond to sophisticated Web and API threats, ensuring robust protection for workloads against evolving risks.

Authentication bypass

The Cortex Cloud authentication bypass module protects against attacks that attempt to circumvent authentication controls through session manipulation, token exploitation, or credential abuse.

Automation tools

Cortex Cloud detects and protects against automated tools or services that scrape website contents such as Scriptable headless web browsers, command line tools, or HTTP libraries.

Cross-Site Scripting (XSS) injection

Cortex Cloud protects against XSS attacks, in which malicious JavaScript snippets are injected into otherwise benign and trusted websites. In such attacks, attackers try to trick the browser into switching to a JavaScript context and executing arbitrary code.

CVE exploits

Cortex Cloud protects against exploitation attempts of known vulnerabilities (Common Vulnerabilities and Exposures (CVEs)).

Malformed Traffic

Cortex Cloud identifies and protects against HTTP requests with anomalies that are not expected from common web browsers.

Injection attacks

Injection attacks are a form of attacks in which attackers attempt to insert malicious input into an application to manipulate its execution. For example, a code injection attack injects code which is interpreted by the application or other runtimes. Command and code payloads can either be injected as part of HTTP requests, or are included from local or remote files (also known as File Inclusion attacks).

Known bots

Cortex Cloud can identify legitimate bots that properly declare their identity and purpose, such as search engine crawlers and authorized web indexers. These bots follow standard protocols and provide verifiable operator information, however some of them might cause undesirable behaviors, such as spam, and you might prefer to block such bots.

Offensive tools

Cortex Cloud identifies offensive tools that scan web applications for known security vulnerabilities and misconfiguration, and exploit them.

Sensitive data exposure

Cortex Cloud protects workloads from providing responses that could expose sensitive data found in critical system files, including password hashes (/etc/shadow), user account information (/etc/passwd), and private encryption keys.

SQL injection (SQLi)

Cortex Cloud protects against SQLi attacks, which can occur when an attacker successfully inserts a malicious SQL query into the input fields of a web application. A successful attack can read sensitive data from the database, modify data in the database, or run arbitrary commands.