Detection & Response Enablement
Aperçu
Palo Alto Cortex XDR Intel connector synchronizes OpenCTI indicators to Palo Alto Cortex XDR, keeping your EDR detection base continuously aligned with your threat intelligence.
Palo Alto Cortex XDR is an extended detection and response (XDR) platform that integrates endpoint, network, and cloud data to detect, investigate, and respond to threats across the enterprise.
This connector consumes STIX Indicators from an OpenCTI live stream, extracts the underlying observables (file hashes, domain names, IP addresses, email addresses, and URLs), and synchronizes them as Indicators of Compromise (IOCs) in Palo Alto Cortex XDR — without any manual IOC management.
Key features:
- Real-time IOC push from OpenCTI live stream to Cortex XDR
- Supports file hashes, domain names, IP addresses, email addresses, and URLs
- Automatic IOC expiration derived from the indicator's valid_until field
- IOC severity mapped from OpenCTI confidence score
- Automatic IOC deletion in Cortex XDR when the indicator is removed in OpenCTI