PSE Cortex key terms

Palo Alto Networks' security operations platform that consolidates SIEM, SOAR, ASM, and endpoint data into a single service, using machine learning to automate detection, triage, and response across the enterprise.

The ingestion channels that feed XSIAM, including endpoint agents, cloud audit logs, network sensors, identity providers, and third-party feeds. Brokers and collector configurations control how raw events reach the platform.

Grouped findings in XSIAM that correlate related alerts and assets into a single investigative unit, giving analysts one case view instead of many disconnected alerts to triage separately.

The machine-learning layer in XSIAM that builds behavioral baselines per user, host, and entity, then raises anomalies when activity deviates from normal patterns without relying on static signatures.

An automated workflow that runs in response to a trigger such as a new issue or alert, executing enrichment, containment, and notification steps without manual analyst action.

A logic definition that evaluates streaming events against conditions and time windows to produce an alert or issue, forming the detection backbone of the platform.

Palo Alto Networks' endpoint detection and response product that collects process, network, and file telemetry from agents, detects malicious behavior, and enables investigation and response on endpoints.

The lightweight software installed on Windows, macOS, Linux, and container hosts that streams telemetry to Cortex XDR, enforces policy, and performs actions such as isolate or terminate process.

A Cortex XDR configuration that defines which protection modules (malware, exploit, injection, ransomware) are enabled and how they act-block, report, or disable-per endpoint group.

A Cortex XDR setting that controls how the agent handles files judged malicious or suspicious, including quarantine, local or cloud analysis, and whether to block execution outright.

Palo Alto Networks' cloud malware analysis service that detonates files and URLs in sandboxes and returns verdicts, feeding those verdicts into Cortex XDR and firewall enforcement.

The visual timeline in Cortex XDR that links a process to its parent, child processes, files, and network connections, letting analysts trace how an attack unfolded on a host.

A response action that cuts a compromised endpoint off from the network except for the management channel, containing lateral movement while allowing investigation to continue.

A single detection raised by an agent, analytics engine, or IOC rule, containing the triggering events, affected endpoint, and severity, which analysts triage and may escalate.

A grouping of related alerts that share entities or attack progression, created manually or by correlation, serving as the unit of investigation and response tracking.

A Cortex XDR indicator-of-compromise rule that matches observed activity-file hashes, IPs, domains-against threat intelligence and raises alerts when endpoints touch known-bad artifacts.

Palo Alto Networks' security orchestration, automation, and response platform that runs playbooks, integrates third-party tools through content packs, and centralizes case management for SOC teams.

A visual, task-based workflow in XSOAR that automates investigation and response steps, branching on conditions and calling integrations, with support for manual approval tasks.

A configured connection between XSOAR and an external product, holding credentials, server URL, and parameters that let playbooks and commands communicate with that tool.

A downloadable bundle in the XSOAR marketplace containing integrations, playbooks, scripts, layouts, and indicator types for a specific product or use case.

The case record in XSOAR that holds alerts, evidence, tasks, and notes for an investigation; its type and fields drive which playbooks run automatically.

A stored observability such as an IP, hash, or domain with reputation and relationships, used to enrich incidents and to score future sightings across investigations.

The collaborative workspace in XSOAR for a single incident, showing the task timeline, chat, evidence, and command results so analysts and automation work in one place.

Palo Alto Networks' attack surface management service that discovers internet-facing assets and exposed services, scores their risk, and helps teams remediate unknown exposure.

The full set of internet-reachable assets, services, and ports an organization exposes, including those unknown to IT, which attackers can scan and attempt to exploit.

A finding that an internet-facing asset is running a risky or vulnerable service, such as an open RDP port or unpatched software, ranked by severity and business context.

The continuously updated record of discovered internet-facing assets, their owning organization, IP ranges, and services, used to identify shadow IT and unmanaged systems.

The discipline of continuously discovering, classifying, and reducing an organization's externally visible attack surface, the core purpose of Cortex Xpanse.

Palo Alto Networks' cloud security offering that combines cloud-native application protection, posture management, and runtime workload protection across public cloud environments.

Cloud security posture management: continuously assessing cloud configurations against benchmarks and policies to find misconfigurations such as public buckets or overly permissive roles.

Cloud workload protection platform: runtime protection for virtual machines, containers, and serverless workloads, detecting and blocking threats such as malware or cryptomining on those workloads.

Cloud infrastructure entitlement management: analyzing identities, roles, and permissions in cloud environments to find excessive or unused access that could be abused by attackers.

The consolidated record of cloud resources-compute, storage, identities, and networks-across accounts and providers, used to scope posture findings and map relationships.

Detection that models normal activity for users, hosts, or entities and flags statistically unusual actions, catching threats that signature-based tools miss.

A Palo Alto Networks component that mediates communication between on-premises data sources and the cloud platform, buffering and forwarding logs when direct connectivity is restricted.

Tagging detections and alerts to adversary tactics and techniques so analysts can see coverage gaps and understand where in an attack lifecycle a detection sits.