What it does
Cortex XDR combines endpoint-security data with network, cloud, identity and other security signals for detection and investigation.
Cortex XDR connects endpoint, network and other available signals in one investigation. Identify the data sources the team can supply: correlation depends on that coverage and on an analyst's response process. The FAQ names BIOCs, IOCs and correlation rules as customizable detection inputs. Evaluate which existing indicators and behavior rules the team can express and what context reaches the resulting timeline.
Strengths
- Cross-source security-event correlation
Best for
- Security operations teams investigating activity across several data sources