External Integrations - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Threat Intelligence

WildFire

Cortex XSIAM automatically includes WildFire threat intelligence in the incident and alert investigation. WildFire detects known and unknown threats, such as malware. The WildFire verdict contains detailed insights into the behavior of identified threats. The WildFire verdict displays next to relevant Key Artifacts in the incidents details page. See Review WildFire Analysis Details for more information.

AutoFocus™

AutoFocus groups conditions and indicators related to a threat with a tag. Tags can be user-defined or come from threat-research team publications and are divided into classes, such as exploit, malware family, and malicious behavior. See the AutoFocus Administrator’s Guide for more information on AutoFocus tags.

To view AutoFocus tags in Cortex XSIAM incidents, you must obtain the license key for the service and add it to the Cortex XSIAM Configuration. When you add the service, the relevant tags display in the incident details page under Key Artifacts.

VirusTotal

VirusTotal provides aggregated results from over 70 antivirus scanners, domain services included in the block list, and user contributions. The VirusTotal score is represented as a fraction, where, for example, a score of 34/52 means out of 52 queried services, 34 services determined the artifact to be malicious.

To view VirusTotal threat intelligence in Cortex XSIAM incidents, you must obtain the license key for the service and add it to the Cortex XSIAM Configuration. When you add the service, the relevant VirusTotal (VT) score displays in the incident details page under Key Artifacts.