Use the interface - Administrator Guide - Cortex XDR - Cortex

Use the interface - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Documentation

Product

Cortex XDR

Creation date

2024-03-06

Last date published

2024-12-30

Note

Each SAML login session is valid for 8 hours.

Interface	Description
Dashboard & Reports	From the Dashboard & Reports menu, you can view and manage your dashboards and reports from the dashboard and incidents table, and view alert exclusions. Dashboard—Provides dashboards that you can use to view high-level statistics about your agents and incidents. Reports—View all the reports that Cortex XDR administrators have run. Customize—Create and manage a new dashboard and reports. Dashboards Manager—Add new dashboards with customized widgets to surface the statistics that matter to you most. Reports Templates—Build reports using pre-defined templates, or customize a report. Reports can be generated on-demand scheduled. Widget Library—Search, view, edit, and create widgets based on predefined widgets and user-created custom widgets.
Incident Response	From the Incident Response menu, you can view, manage, investigate and take action on all incidents. Incidents—Investigate and manage your incidents. Investigation Query Builder—Build complex queries to investigate, identify connections, and expose the root cause of alerts from your data sources. Query Center—View and manage the results of all simple and complex queries created from the Query Builder. Scheduled Queries—View and manage all scheduled and reoccurring queries created from the Query Builder. Forensics—Streamline your incident response, data collection, threat hunting, and analyses of your endpoint data to find the source and scope of an attack. Host Inventory— Access comprehensive insights into your system's components, including applications, services, users, and vulnerability assessments, to maintain visibility and security across your environment. Response Action Center—Provides a central location from which you can track the progress of all investigation, response, and maintenance actions performed on your endpoints. Live Terminal—Initiate a remote connection to an endpoint enabling you to remotely manage, investigate, and perform response actions on the endpoint. EDL—Add malicious domains and IP addresses to an external dynamic list enforceable on your Palo Alto Networks firewall. Incident Configuration—Create a starring configuration that automatically categorizes and starts incidents when a related alert contains specific attributes that you define as important.
Detection & Threat Intel	From the Detection menu, you can define specific rules for which you want Cortex XDR to raise alerts. Detection Rules IOC—Identify specific hashes, IP addresses, domains, file names, and paths that indicate a threat. BIOC—Identify a specific network, process, file, or registry activity that indicates a threat. Correlations—Analyze correlations of multi-events from multiple sources. Exceptions—Define exception criteria for an IOC or BIOC rule.
Assets	From the Assets menu, you can define your network parameters and view a list of all the assets in your network. Asset Inventory—Provides a central location from which you can view and investigate information relating to assets in your network. Network Configuration—Define your internal IP address ranges and domain names to identify and track your network assets. Vulnerability Assessment—Identify and quantify the security vulnerabilities on an endpoint. Asset Scores—Investigate user and host activities, and detect compromised accounts and malicious devices using the Cortex XDR calculated User and Host Scores. Cloud Inventory—Provides a unified, normalized asset inventory for cloud assets in Google Cloud Platform, Microsoft Azure, and Amazon Web Services.
Endpoints	From the Endpoints menu, you can manage your registered endpoints and configure the policy. All Endpoints—View and manage endpoints that have registered with your Cortex XDR instance. Endpoint Groups—Create endpoint groups to which you can perform actions and assign the policy. Agent Installations—Create packages of the Cortex XDR agent software for deployment to your endpoints. Policy Management—Configure your endpoint security profiles and assign them to your endpoints. Host Firewall—Control communications on your endpoints by applying sets of rules that allow or block internal and external traffic. Device Control Violations—Monitor all instances where end users attempted to connect restricted USB-connected devices and Cortex XDR blocked them on the endpoint. Disk Encryption Visibility—View and manage endpoints that were encrypted using BitLocker.
Managed Services	The Managed Threat Hunting service augments your security by providing 24/7, year-round monitoring by Palo Alto Networks threat researchers and Unit 42 experts.
Quick Launcher	Open an in-context shortcut that you can use to search for information, perform common investigation tasks, or initiate response actions from any place in the Cortex XDR console.
Settings	From the Settings menu, you can view information about your Cortex XDR license, review logs of actions initiated by Cortex XDR analysts, and configure Cortex XDR settings, integrations with other apps and services, and access management.
Tenant Navigator	View and switch to tenants to which you have access divided per CSP account. You can also navigate directly to the Cortex Gateway.
Notifications	View Cortex XDR notifications.
Help	Cortex XDR offers in-product help providing you with guidance directly from within the Cortex XDR Management Console. From the Help, you can choose: Documentation Portal to open the Cortex Help Center. Toggle on/off the In-App Help Center. If on, the appears at the bottom right side of the page. Submit a Support Case Click to open the Help Center. The topics listed in the panel reflect the current page opened in the Cortex XDR Management Console. You also have the option of entering a topic or keyword in the search bar for any information you are looking for. Click the star at the top right hand side of the topic to add to the list of favorites. The list of favorites is saved to the home page of the Cortex Help Center panel.
User	From the User, see who is logged into Cortex XDR . Right-click and select: About to view additional version and tenant ID information. What’s New in this Release to view selected new features available for your license type. What's New in XSIAM Log Out to terminate the connection with your Cortex XDR Management Console.

Filter page results

To reduce the number of results, you can filter by any heading and value. When you apply a filter, Cortex XDR displays the filter criteria above the results table. You can also filter individual columns for specific values using the icon to the right of the column heading.

Some fields also support additional operators such as =, !=, Contains, not Contains, *, !*.

There are three ways you can filter results:

Filters are persistent. When you navigate away from the page and return, any filter you added remains active.

To build a filter using one or more fields:

From a Cortex XDR page, select filter ().
Cortex XDR adds the filter criteria above the top of the table.
For each field you would like to filter by:
1. Select or search the field.
2. Select the operator that matches the criteria.
  Use = to include results that match the value you specify, or != to exclude results that match the value.
3. Enter a value to complete the filter criteria.
  Note
  CMD fields have a 128-character limit. Shorten longer query strings to 127 characters and add an asterisk (*).
  Alternatively, you can select Include empty values to create a filter that excludes or includes results when the field has empty values.
To add additional filters, click +AND, within the filter brackets, to display results that must match all specified criteria, or +OR to display results that match any of the criteria.
To see the results, click out of the filter area.

Export results to file

You can export the page results for most pages in Cortex XDR to a tab-separated values (TSV) file.

(Optional) Filter page results to reduce the number of results for export.
Select export to file ().
Cortex XDR exports any results matching your applied filters in TSV format. The TSV format requires a tab separator, automatic detection does not work in the case of multi-event exports.

Save and share filters

You can save and share filters across your organization.

Save a filter:
Saved filters are listed on the Filters tab for the table layout and filter manager menu.
1. Save () the active filter.
2. Enter a name to identify the filter.
  You can create multiple filters with the same name. Saving a filter with an existing name does not override the existing filter.
3. Choose to Share this filter, or keep it private for your use only.
Share a filter:
You can share a filter across your organization.
1. Select the table layout and filter menu indicated by the three vertical dots, then select Filters.
2. Select the filter to share and click the share icon.
3. You can later unshare () or delete () a filter.
  Unsharing a filter turns a public filter private. Deleting a shared filter removes it for all users.