Cortex Cloud
Cortex Cloud is Palo Alto Networks' cloud-native application protection platform (CNAPP). It combines cloud posture, runtime protection, application security, and data and identity security. The exam tests code-to-cloud coverage, how findings are prioritized, and how cloud risk reaches the SOC.
Coverage areas
- Cloud Posture (CSPM): misconfigurations and compliance against benchmarks across cloud accounts.
- Cloud Runtime (CWPP/CDR): workload and container protection plus cloud detection and response.
- ASPM: application security posture across code and pipelines.
- CIEM and DSPM: identity entitlements and sensitive data exposure.
- Agentless scanning gives broad visibility; the Cortex Cloud agent adds runtime telemetry and enforcement.
Prioritization
- Findings are correlated into attack paths, so a medium misconfiguration that enables lateral movement can outrank an isolated informational finding.
- Policies and compliance standards determine what the console labels critical.
- Integration with Cortex XSIAM pushes cloud findings into the SOC incident workflow.
Worked example
A public S3 bucket is flagged medium by a benchmark, but it sits on an attack path to an instance role with admin permissions. Reasoning: do not triage on benchmark severity alone. Check the attack path: public data store plus over-privileged role plus reachable compute raises real risk. Fix the bucket policy or the entitlement, then rescan to confirm the path is broken.
Traps
- Treating Cortex Cloud as only CSPM; it also covers runtime, code, data, and identity.
- Equating benchmark severity with business risk; attack paths change priority.
- Assuming agentless scanning provides runtime blocking - it does not.
- Forgetting that cloud findings can be forwarded to XSIAM or XSOAR for response.