Palo Alto Networks' XDR platform that connects endpoint, network, cloud, and identity data to detect and stop attacks. It uses behavioral analytics and AI to group alerts into incidents and provide root-cause analysis.
What is Cortex XDR?
Cortex XDR is Palo Alto Networks' extended detection and response platform, designed to break down the silos between endpoint, network, cloud, and identity telemetry. It deploys a single lightweight agent on endpoints that collects behavioral data and sends it to a central analytics engine. That engine applies AI-driven behavioral analytics to group related events into coherent incidents, each with a root-cause visualization that shows exactly how an attack unfolded. Beyond detection, Cortex XDR supports active response: isolating endpoints, killing processes, blocking network connections, and running live forensic queries remotely. Its integration with the broader Palo Alto Networks ecosystem means that detections can automatically trigger firewall policy updates or WildFire sandbox submissions.
How does Cortex XDR work with Qevlar?
Qevlar connects to Cortex XDR to retrieve endpoint alerts and process-level telemetry during automated investigations. When an incident is triggered, Qevlar can query XDR for the full behavioral timeline on an affected host, correlating that data with network and identity signals to build a complete picture of the threat before an analyst reviews it.
Want to help your analysts focus on the most critical alerts?
Frequently asked questions
What is Cortex XDR?
Cortex XDR is Palo Alto Networks' extended detection and response platform. It unifies endpoint, network, cloud and identity telemetry, using behavioral analytics to group related events into incidents with root-cause context.
What can you do with Cortex XDR in Qevlar?
Qevlar can ingest Cortex XDR alerts and query the platform for endpoint, network and identity telemetry during an investigation — reconstructing the behavioral timeline on an affected host and correlating it with other sources automatically.
Does Qevlar investigate Cortex XDR alerts on its own?
Yes. When an incident is raised, Qevlar pulls the relevant process, file, network and authentication events, reaches a verdict and presents the analyst with a complete, evidence-backed case.
How does Qevlar fit with my Palo Alto stack?
Qevlar adds an autonomous investigation layer on top of Cortex XDR, so teams already invested in the Palo Alto ecosystem can extend their automation coverage without changing their detection setup.
Other integrations
