Cortex XDR and Cortex Xpanse
This section pairs two product domains. Cortex XDR covers endpoint and identity operations - prevention policy, analytics detection, causality analysis, XQL hunting, response actions. Cortex Xpanse covers attack surface management - discovering internet-facing assets, attributing them to you, scoring exposures and driving remediation.
Cortex XDR core rules
- The agent enforces prevention policies (malware, exploit, device control, disk encryption) while analytics and BIOCs detect behavior signatures miss.
- Alerts roll into incidents with a causality chain: process tree, endpoints, users. Read the chain before acting.
- XQL queries endpoint telemetry across the estate; use it to scope an incident, not only to investigate it.
- Response actions: isolate endpoint, terminate process, quarantine file, block hash, restore file. Preserve evidence, then contain, then eradicate.
Cortex Xpanse core rules
- Xpanse continuously discovers internet-connected assets and attributes them using evidence such as certificate subjects, WHOIS and network registration.
- Inventory is the foundation: CMDB records and prior scan lists are incomplete by definition; unknown assets are the exam's recurring theme.
- Exposures are findings on discovered assets, evaluated by attack surface rules and prioritized by exploitability and business context; remediation routes through owners and ticketing, integrated with XSIAM and XSOAR.
Worked example
An endpoint shows Office spawning PowerShell that deletes volume shadow copies. Reasoning: ransomware staging, not a false positive. Preserve the process tree, isolate to cut command-and-control, quarantine the payload, block the hash, then hunt with XQL for the same command line across the estate before tuning anything. Second example: an unknown IP with open RDP and a certificate matching a subsidiary domain is attributed to you; confirm ownership, open a ticket, and onboard it to XSIAM - do not block first, since a business-critical service may be cut.
Traps
- Confusing a prevention-policy block with an analytics alert.
- Terminating a process before collecting the causality chain.
- Applying a global exception after one noisy endpoint.
- Treating Xpanse as a vulnerability scanner only, or ignoring attribution confidence.