thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Cortex XDR

Palo Alto Networks' extended detection and response platform combining endpoint protection with network, cloud and identity analytics.

Definition

Cortex XDR uses an endpoint agent for prevention (malware, exploit and behavioral protection) and EDR, and ingests firewall, cloud and third-party data into a data lake for analytics. It groups alerts into incidents, shows causality chains and supports response actions such as isolation and live terminal. Queries use XQL.

Example

Isolating an endpoint and running a script from Cortex XDR after a BIOC alert.

Exam tip

Know agent components (exploit protection, malware protection, behavioral threat protection) and that alerts are grouped into incidents.

Related terms