We at Palo Alto Networks are honored to be included in CRN’s 10 Hottest XDR Security Companies to Watch in 2022. And as a part of an elite pack of security vendors, we embrace healthy competition that ultimately pushes the entire industry to innovate, think outside the proverbial box, and most importantly, keep all companies secure.
In just a short time, Extended Detection and Response (XDR) has gone from a somewhat maverick concept for reimagining how to detect, respond and stop attacks more efficiently and effectively to an industry-wide phenomena. As such, XDR is recognized and adopted by leading security vendors, researchers and analysts.
The XDR concept was introduced to the market in 2018 by our very own Nir Zuk, CTO and Co-Founder of Palo Alto Networks. His vision created a seamless approach to preventing attacks at the endpoint and then detecting and responding to attacks that cannot be prevented by pulling disparate telemetry together from multiple sources, including endpoint detection and response (EDR), network traffic analysis (NTA), cloud security, user and entity behavior analytics (UEBA) and Indicators of Compromise (IoCs).
“Our mission is to empower organizations to know about and stop all attacks by ingesting, integrating and analyzing every data source to encompass the entire environment, and leveraging multi-layer cross-data analytics for higher fidelity detection, continuous learning for automated investigation and response, and all threat context and insight in one place.” – Cortex Mission Statement
As XDR gains traction, it makes sense to thoroughly evaluate what’s available in the market and to distinguish and determine what are true XDR solutions as opposed to another vendor hopping on the XDR bandwagon. XDR takes prevention capabilities further than NGAV or EDR, offering full-scale visibility and powerful analytics that security teams need to fight modern attacks now and in the future. The following specifications (while not exhaustive) can help narrow down potential XDR options.
Does the Solution Take a Prevention-First Approach?
While XDR is defined as “extended detection and response,” its strength lies in the ability to prevent attacks to block, disrupt and contain threats and attacks before any damage occurs. For all other activities, XDR helps detect attacker TTPs (techniques, tactics and procedures) by building a complete record of communications and tracking all endpoint activities, as well as how users interact with all applications and data.
A True XDR solution:
- Optimizes triage and investigations by surfacing all related malicious artifacts, hosts, users and correlated alerts and mapping them to MITRE ATT&CK.
- Automatically and natively stitches together key data into a single “story” or integrated log record for cross-data analytics.
- Applies intelligent, advanced logic to show the complete story of an incident in a single view.
- Automatically maps evidence and artifacts to the MITRE ATT&CK framework and provides smart recommendations for targeted response actions, based on MITRE ATT&CK.
- Provides a built-in capability to perform deep forensic analysis.
- Allows for native response actions on the endpoint.
- Enables response across endpoint, network and cloud enforcement points vs. endpoint only.
- Is backed by world-class security research and security services teams.
- Uses security analytics to automate response recommendations.
- Allows native support for ad-hoc searching across all third-party data sources, using analyst-optimized, investigative and hunting methods.
Cortex XDR IS What’s Next
Cortex XDR heralds the next evolution of EDR, bringing prevention capabilities further than any NGAV or EDR can. It offers integrated visibility and powerful analytics, giving security teams what they need to stay ahead of the security curve. The future is about to get even hotter, so let’s bring the heat!
Learn More About XDR Today
Download our “XDR for Dummies” eBook to learn more about XDR.
And, visit our webpage to learn more about Cortex XDR.