PSE Cortex cheat sheet

XSIAM is a SecOps platform that fuses EDR, NDR, UEBA, ASM, and SIEM data into a single detection and response console built on the Cortex Data Lake.

Three core pillars: Prevention (endpoint agents), Detection (analytics and correlation engines), and Response (automation playbooks and War Room).

XSIAM ingests data via brokers and collectors; brokers are deployed on-premises to pull logs from local sources and forward them to the cloud tenant.

Detection uses behavioral analytics (Analytics BIOC) plus correlation rules; BIOC stands for Behavioral Indicator of Compromise and is written in a YAML-like syntax.

Incident grouping merges related alerts into a single incident via issue grouping rules, reducing alert fatigue; tuning happens in the Detection Rules and Issue Grouping settings.

XSIAM's attack surface management (ASM) module discovers external-facing assets and scores risk from the outside-in perspective without requiring an agent.

Automation in XSIAM reuses XSOAR playbook engine: playbooks trigger on incident creation, and tasks can call scripts, commands, or external integrations.

Health and data ingestion monitoring is done from Settings > Data Sources and the Health page; ingestion lag and parsing errors surface there first.

XDR agent runs on Windows, macOS, and Linux endpoints; it performs local behavioral analysis and can block malicious activity even when the endpoint is offline.

Agent communication uses a broker/cloud channel over TLS; if the endpoint cannot reach the cloud, it buffers events locally until connectivity returns.

Protection modules include Malware, Exploit, Ransomware, Behavioral Threat, and (on Windows) Local Analysis; each can be set to Off, Report, or Block.

Alert vs Incident: alerts are individual detections; incidents are correlated groups of alerts tied to a causality chain (process tree) and a single endpoint.

Causality chain shows the process ancestry leading to a detection; the root cause process and the initiating user are key triage fields.

Exception and allowlist policies are configured per profile; a Wildfire verdict of malicious on a hash typically triggers a quarantine action.

Incident response actions include isolate endpoint, terminate process, quarantine file, and retrieve file; isolate blocks all traffic except the XDR management channel.

The XDR agent is managed via endpoint policy profiles assigned by endpoint groups; a profile defines the modules, scan schedule, and agent settings.

XSOAR is a SOAR platform combining case management, a playbook engine, and hundreds of integrations (content packs) for third-party tools.

Playbooks are built from tasks; task types include standard, conditional, manual, and script; conditional tasks branch on the output of prior tasks.

The War Room is the per-incident chat and evidence area; commands typed there (e.g., !ip) run integration commands and results are stored as context.

Context is a JSON data store per incident; playbook tasks reference it with dot notation, e.g., ${incident.id} or ${IP.Address}.

Incident types and fields define schema; layouts control what analysts see; classifiers and mappers translate incoming data into incidents.

Integrations are configured as instances with credentials; commands are invoked from playbooks or the CLI with the ! prefix.

Content packs bundle playbooks, scripts, integrations, and layouts; they are installed from the Marketplace and can be version-pinned.

Automation scripts are Python or JavaScript; the CommonServerPython library provides helper functions for commands, demisto.results, and context output.

Xpanse is an attack surface management (ASM) product that discovers internet-facing assets from the outside-in without deploying agents.

Discovery scans the entire IPv4 space and uses response fingerprints to attribute services, ports, and technologies to an organization.

Assets are associated to an organization via ownership rules: IP ranges, ASNs, certificates, and domain patterns; misattribution is corrected via these rules.

Risk scoring considers exposure, exploitability, and business criticality; findings are surfaced as issues ranked by risk.

Xpanse integrates with XSOAR and XSIAM so discovered exposures can trigger automated remediation playbooks.

Attack surface rules let you define which services are expected vs unexpected; unexpected services on owned IPs are high-signal findings.

Xpanse does not require an agent; it complements XDR by covering assets you may not know exist (shadow IT, forgotten cloud instances).

Remediation guidance includes the owning team and the specific exposed service; tagging and ownership assignment drive the workflow.

Cortex Cloud (formerly Prisma Cloud) provides CNAPP capabilities: CSPM, CWPP, CIEM, and code/CI security across AWS, Azure, GCP, and Kubernetes.

CSPM evaluates cloud resource configurations against compliance benchmarks (CIS, PCI DSS, SOC 2) and surfaces misconfigurations as alerts.

CWPP protects cloud workloads (VMs, containers, serverless) with runtime defense and vulnerability management.

CIEM analyzes effective permissions to find excessive or unused privileges and identifies risky identity paths.

Onboarding uses a cloud account integration (read-only role) plus optional agentless scanning and workload defenders for runtime protection.

Policies are the core unit: a policy defines the rule, severity, and remediation; policy compliance is mapped to compliance standards.

Attack path analysis chains misconfigurations, identities, and network exposure to show how an attacker could reach critical data.

Alerts flow into the Cortex platform and can be investigated alongside XSIAM/XDR incidents for unified response.