Cortex Xpanse
Cortex Xpanse is attack surface management (ASM). It discovers internet-facing assets from the outside in, attributes them to your organization, and flags exposures. The exam tests the discovery model, the asset-versus-exposure distinction, and rule-driven response.
Discovery model
- Xpanse scans the internet and correlates IPs, domains, certificates, and services to identify assets - including shadow IT, forgotten cloud instances, and rogue services.
- It is agentless and outside-in; it is not an authenticated vulnerability scanner.
- Exposures are findings on assets, such as an exposed service or a weak certificate.
- Attack Surface Rules decide which exposures matter and can trigger an alert or an active response.
Active response
- A rule combines conditions with an action: alert only, or enforce through an integrated enforcement point such as a Palo Alto NGFW, or through an XSOAR playbook.
- Response can block or quarantine an internet-facing service without an endpoint agent.
Worked example
Marketing creates an unapproved cloud VM with SSH open to the internet. Xpanse discovers the IP and service through scanning, attributes it using certificate, WHOIS, and organization data, and creates an asset. Attack Surface Rules evaluate it; a rule matching 'SSH exposed to internet on a production-tagged asset' raises an exposure and can invoke active response to block port 22 at the firewall. No agent on the VM is expected.
Traps
- Expecting Xpanse to need an agent or credentials on the target.
- Confusing an asset (the thing) with an exposure (the finding).
- Assuming every rule action blocks; some only alert.
- Skipping attribution - an IP in scan data is not automatically yours.