Palo Alto SecOps Architect cheat sheet

Cortex platform AI stack has three layers: detection/analytics engines (UEBA, behavioral analytics), triage automation (alert grouping, incident scoring), and analyst-facing assistants (natural-language query, playbook generation).

Alert grouping reduces volume by clustering related alerts into a single incident on shared entities (host, user, IP, hash); grouping rules are evaluated before incident scoring, so tuning grouping rules changes what the scoring model sees.

Incident scoring is a 0-100 relative severity value computed from alert severity, asset criticality, identity risk, and threat intelligence enrichment; it is dynamic and recalculates as new evidence arrives, so it is not a static field.

Behavioral analytics (UEBA) baselines per-entity activity; risk scores accumulate on users and hosts and decay over time, so a single low-severity event can raise risk but sustained deviation is required for high-risk designation.

Causality and incident linking chains alerts that share an initiating process, user session, or network flow; the root cause node is the earliest causal anchor, and closing the root cause closes linked child alerts when configured.

Automation in the platform runs as playbooks triggered by incident creation, alert creation, or manual invocation; playbook execution is logged as a war room entry with task-level input/output for audit.

AI-assisted investigation outputs must be treated as hypotheses: every generated conclusion should be validated against raw telemetry (process, network, identity logs) before containment actions are taken.

Licensing and data residency determine which AI features are available: cloud analytics require telemetry forwarded to the region-specific tenant, while on-premises deployments limit model-driven features to those bundled locally.

XSIAM is a SIEM-plus-SOAR-plus-XDR platform whose data model normalizes logs into a schema (XDM) so that detection, correlation, and query work identically across endpoint, network, identity, and cloud sources.

Ingestion paths: brokers handle collection and buffering, then data flows to the analytics engine; broker health (CPU, disk, connectivity) is the first check when data stops appearing in queries.

Detection content is expressed as correlation rules over XQL; a rule has a query, a schedule or streaming trigger, and an alert template that maps fields into the incident schema.

XQL is a piped query language: dataset selection, then filters, then aggregations; functions like alter, fields, stats, and join are applied left to right, so filter early to reduce scan cost.

Incident creation from a correlation rule depends on the rule's severity mapping and grouping configuration; identical alerts suppressed by grouping still appear in the alert table but not as separate incidents.

Playbook and automation engine in XSIAM shares the XSOAR playbook runtime; custom integrations are installed as content packs and require an instance configuration with credentials and a test before use.

Data retention is tiered: hot storage for recent searchable data and cold/archive tiers for compliance; queries against cold tiers are slower and may be limited by license tier.

Health and troubleshooting signals to check first: broker status, dataset ingestion lag, license consumption against daily volume, and rule execution errors in the audit log.

XSOAR architecture: the server hosts the API, playbook engine, and database; engines run playbook tasks (including Docker-based scripts); integrations are Python packages executed by the engine.

Incident lifecycle states are configurable but typically follow New → Assigned → In Progress → Resolved/Closed; closing requires a close reason, and reason codes drive reporting on detection quality.

Playbook task types: standard (integration command or script), conditional (router), manual (analyst decision), and section headers; each task can define a timeout and a next-task mapping per outcome.

Context data is a JSON store keyed by path; DeleteContext and Set manipulate it, and ${incident.fieldname} versus ${incident.customFields.x} referencing errors are a common cause of empty task inputs.

Incident types and layouts are defined per type; fields marked required are enforced at creation, and custom fields must be added to the layout to appear in the UI.

Classification and mapping: an incoming incident is classified (e.g., phishing, malware) and mapped to a type; misconfigured classifiers send incidents to the wrong playbook, so test with sample payloads.

Indicators live in a separate database from incidents; reputation commands (e.g., !ip) enrich indicators, and indicator expiration and scoring are configured in the indicator type settings.

Content packs bundle integrations, playbooks, scripts, and layouts with version numbers; installing a pack can overwrite customized content, so detach or fork before editing.

XDR collects endpoint telemetry through the Cortex XDR agent: process execution, file operations, network connections, registry changes, and injected code, plus optional network and cloud data sources.

The causality chain is the core investigation view: it links processes, files, and network activity into a tree anchored at a root cause, letting an analyst see the full attack sequence from a single alert.

Prevention policy vs. security policy: prevention settings (malware, exploit, restriction profiles) block activity on the endpoint; security settings govern detection, exclusions, and agent behavior.

Agent installation modes: standalone (local management) vs. managed by the Cortex XDR console; agent upgrades are controlled by an agent settings profile with version targeting.

Alert severity and star ratings differ: severity is the detection's intrinsic risk, while the star rating is the analyst's judgment recorded for tuning; both feed reporting and exclusion decisions.

Exceptions and exclusions must be scoped narrowly (by hash, signer, path, or command line) and reviewed periodically; broad exclusions are the most common cause of missed detections.

Incident response actions (isolate endpoint, terminate process, quarantine file) execute through the agent and are logged in the action center with status; isolation restricts network except for the management channel.

Xpanse discovers internet-facing assets by scanning public IP space and attributing observed services to an organization using registration, certificate, and network evidence rather than installed agents.

Attribution confidence is a probability-like score; low-confidence attributions should be confirmed before remediation, because acting on a misattributed asset can disrupt a third party.

Asset types include domains, IP addresses, certificates, and cloud resources; each has a state (e.g., approved, unapproved, flagged) that determines whether it appears in the attack surface inventory.

Exposure categories map findings to risk: e.g., exposed remote access, vulnerable services, misconfigured cloud storage; each finding carries severity and remediation guidance.

Xpanse integrates with XSOAR and XSIAM for automated remediation: findings become incidents, and playbooks can open tickets or trigger cloud configuration changes.

Cloud connectors (AWS, Azure, GCP) reconcile discovered assets with cloud inventory; assets found by scanning but absent from cloud inventory indicate shadow IT or orphaned resources.

Remediation workflow: review finding, verify attribution and ownership, assign to owner, remediate at the source, then re-scan to confirm; closing without re-scan risks false closure.

Alert grouping clusters alerts on shared entities (host, user, IP, hash) before scoring, so grouping changes alter the input set for incident scoring.

Incident scoring is a dynamic 0-100 relative value recalculated as new evidence arrives; it is not a static field.

UEBA risk accumulates on users and hosts and decays over time; sustained behavioral deviation is required for high-risk designation.

Causality linking anchors alerts to an earliest root-cause node; closing the root cause can close linked children when configured.

Playbooks trigger on incident creation, alert creation, or manual invocation, and each task logs input/output in the war room for audit.

AI-generated investigation conclusions are hypotheses and must be validated against raw process, network, and identity telemetry before containment.

Cloud AI features require telemetry in the region-specific tenant; on-premises deployments expose only locally bundled model features.

XSIAM unifies SIEM, SOAR, and XDR on a normalized schema (XDM) so detection and query behave the same across endpoint, network, identity, and cloud sources.

Brokers collect and buffer data before the analytics engine; broker CPU, disk, and connectivity are the first checks when queries return no data.

Correlation rules pair an XQL query with a schedule or streaming trigger and an alert template that maps fields into the incident schema.

XQL pipes evaluate left to right; filter early with fields/filter to cut scan cost before stats or join.

Grouping-suppressed alerts still appear in the alert table but do not create separate incidents; severity mapping controls incident creation.

The XSIAM automation engine shares the XSOAR playbook runtime; custom integrations install as content packs and need a configured, tested instance.

Retention is tiered: hot searchable storage plus cold/archive tiers; cold queries are slower and license-limited.

First troubleshooting signals: broker status, dataset ingestion lag, daily volume vs. license, and rule execution errors in the audit log.

Server hosts API, playbook engine, and database; engines execute tasks including Docker-based scripts; integrations are Python packages run by engines.

Incident states are configurable (typically New → Assigned → In Progress → Resolved/Closed); closing requires a close reason that drives detection-quality reporting.

Task types are standard (command/script), conditional (router), manual (analyst decision), and section header; each supports timeouts and per-outcome next-task mapping.

Context is a JSON store keyed by path; Set and DeleteContext manipulate it, and ${incident.customFields.x} path errors cause empty task inputs.

Incident types and layouts define fields; required fields are enforced at creation, and custom fields must be added to the layout to display.

Classifiers route incoming incidents to a type; test with sample payloads because misclassification sends incidents to the wrong playbook.

Indicators live in a separate DB from incidents; reputation commands enrich them, and expiration/scoring are set per indicator type.

Content packs bundle integrations, playbooks, scripts, and layouts with versions; installing can overwrite customizations, so detach or fork before editing.

The Cortex XDR agent records process execution, file operations, network connections, registry changes, and injected code, plus optional network and cloud sources.

The causality chain links processes, files, and network activity into a tree anchored at a root cause, showing the full attack sequence from one alert.

Prevention settings block on the endpoint (malware, exploit, restriction profiles); security settings govern detection, exclusions, and agent behavior.

Agents run standalone or managed by the console; upgrades are controlled by an agent settings profile with version targeting.

Severity is the detection's intrinsic risk; the star rating is the analyst's judgment, and both feed reporting and exclusion tuning.

Scope exceptions narrowly by hash, signer, path, or command line; broad exclusions are a leading cause of missed detections.

Response actions (isolate endpoint, terminate process, quarantine file) run through the agent and log in the action center; isolation permits only the management channel.

Xpanse discovers internet-facing assets by scanning public IP space and attributing services via registration, certificate, and network evidence, not installed agents.

Attribution confidence is a probability-like score; confirm low-confidence attributions before remediation to avoid disrupting a third party.

Asset types include domains, IPs, certificates, and cloud resources; state (approved, unapproved, flagged) determines inventory visibility.

Exposure categories map findings to risk (exposed remote access, vulnerable services, misconfigured storage), each with severity and remediation guidance.

Xpanse feeds XSOAR and XSIAM so findings become incidents and playbooks can open tickets or change cloud configuration.

Cloud connectors (AWS, Azure, GCP) reconcile discovered assets against cloud inventory; scanned-but-uninventoried assets signal shadow IT.

Remediation runs review → verify attribution → assign owner → fix at source → re-scan to confirm; closing without re-scan risks false closure.