Cortex XDR Gets Smarter with Stronger Insights and Broader Visibility

Feb 01, 2021
5 minutes
74 views

Supercharge your investigations with intelligent incident scoring, enhanced search visualization and support for the richest set of data sources ever.

Today, we released Cortex XDR 2.7 and Cortex XDR Agent 7.3, which, together, deliver a huge set of highly anticipated features that speed up investigations and boost the defenses of the Cortex XDR endpoint agent. These new capabilities not only block fast-moving endpoint attacks and help you reduce the mean-time-to-respond (MTTR) to incidents, they help deliver, in conjunction with Cortex XSOAR, an integrated platform for all your SecOps needs.

Incident Scoring Lets You Focus on What Matters

Security teams face today an endless deluge of alerts – to the tune of 11,000 alerts per week on average. Our innovative Incident Management feature, introduced in 2019, alleviates alert fatigue by grouping related alerts from multiple data sources into incidents, cutting the number of individual events to review by 98%.

In Cortex XDR 2.7, we’ve taken Incident Management to the next level with the introduction of incident scoring. A highly sought-out feature for customers, incident scoring lets you rank and prioritize high-risk incidents to swiftly zero in on the most critical threats. You can create incident scores based on over a dozen alert attributes, including the users or hosts in an alert. To simplify rule creation, you can upload a list of high-priority assets. With incident scoring, you can quickly home in on incidents that involve sensitive servers, for example, or prioritize attacks targeting your executive leadership team.

Incident Management reaches the next level with the introduction of incident scoring. The screenshot here shows how incident scores reveal high-risk threats in Cortex XDR 2.7.
Incident scores reveal high-risk threats.

 

Flexible Insights Supercharge Your Investigations

Collecting the right data is the first step for effective detection and response. But all too often, SOC analysts end up drowning in the expansive data lakes they’ve built. To investigate threats, analysts need to quickly find the answers they’re looking for and decipher investigative clues in a snap by reviewing charts rather than scrolling through neverending tables. Reducing incident response time requires better search insights and more flexible queries.

With Cortex XDR 2.7, the search for exceptional search is over. To better visualize search results, Cortex XDR automatically generates graphical histograms for every field in a query. New search options let you analyze more types of data, while query language enhancements, such as optional case-insensitive searches, let you hunt down threats with ease.

You can now display search results using a wide array of charts and visualization options including:

  • Pie charts.
  • Area graphs.
  • Bubble graphs.
  • Scatter graphs.
  • Gauge graphs.
  • Single value totals and tables, in standard text, JSON and tree view formats.

A new widget library allows you to save your personalized charts and use them in dashboards, reports and search results. The widget library is your one-stop shop for all customized charts and graphs.

Cortex XDR 2.7 includes bubble charts that let you assess search results by showing you three dimensions of data at once, as shown in this screenshot of the interface.
Bubble charts let you quickly assess search results by showing you three dimensions of data at once.
Cortex XDR 2.7 now includes custom pie charts, as shown in this screenshot, that help analysts quickly identify top search results, easing investigations.
Custom pie charts help analysts quickly identify top search results, easing investigations.
XQL-QUERY-59, an example of Cortex XDR 2.7 in action, breaks down search results by search field in a histogram.
Histograms show the breakdown of search results by search field.

 

Visibility Across Even More Data Sources Eliminates Blind Spots

Two years ago, we launched the industry’s first extended detection and response platform to empower organizations to hunt down and eliminate threats across siloed data sources. In Cortex XDR 2.7, we are continuing to fulfill this promise by adding new data sources and log formats that expand our visibility, allowing your team to protect an unprecedented number of assets and stop more threats than ever.

Cortex XDR has added support for new log formats, including LEEF and Elastic Filebeat, and can ingest additional types of log files, including AWS® CloudTrail, Amazon CloudWatch, Google Kubernetes® Engine and PingFederate®.

 

Endpoint Agent Enhancements

To keep you fully protected from modern endpoint attacks, we have introduced the Cortex XDR agent 7.3. This release improves feature parity across operating systems and adds new defenses to block vulnerable drivers and stop attacks originating from malicious remote hosts. Key enhancements include:

  • Expanded response options for macOS® endpoints, including Search and Destroy and network isolation, let you instantly stop the spread of malware and swiftly contain threats.
  • Peer-to-peer updates for macOS and Linux allow you to reduce internet bandwidth usage by retrieving updates from other endpoints, such as the existing peer-to-peer content distribution for Windows endpoints.
  • Device Control for virtual desktops enables you to granularly control USB access to virtual desktop infrastructure (VDI) clients and prevent data loss and threats from unsanctioned USB devices.

For a complete list of new features, check out the Cortex XDR release notes. You can also read about our latest updates to neutralize SolarStorm, variants and imitators, as part of our unceasing effort to protect customers from the latest threats.

Join us for the webinar, “Cortex XDR 2.7: Supercharged Investigations,” on Feb. 10 at 10 a.m. PST.

 

 


Subscribe to the Newsletter!

Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.