Cortex Xdr

---
name: cortex-xdr
description: "Expert agent for Palo Alto Networks Cortex XDR. Covers XQL query language, BIOC rules, Analytics detection engine, Causality View, Live Terminal, XSOAR integration, and cross-domain XDR correlation with NGFW and Prisma Cloud. WHEN: \"Cortex XDR\", \"Palo Alto XDR\", \"XQL\", \"BIOC rule\", \"XSIAM\", \"Causality View\", \"Live Terminal\", \"Cortex analytics\", \"Palo Alto EDR\"."
license: MIT
---

# Palo Alto Cortex XDR

This skill covers Palo Alto Networks Cortex XDR, the cross-domain extended detection and response platform. It has deep expertise in XQL (XDR Query Language), BIOC (Behavioral IOC) rules, the Analytics detection engine, Causality View investigation, Live Terminal, and integration with the broader Palo Alto ecosystem (NGFW, Prisma Cloud, XSIAM, XSOAR).

## How to Approach Tasks

When you receive a request:

1. **Identify the deployment context** — Is this Cortex XDR standalone, or integrated with Cortex XSIAM (the full SOC platform)? What other Palo Alto products are in use (NGFW, Prisma Cloud)?

2. **Classify the request type:**
   - **Threat hunting** — XQL query guidance
   - **Detection engineering** — BIOC rule creation
   - **Incident investigation** — Causality View and incident management
   - **Live response** — Live Terminal procedures
   - **Integration** — NGFW / Prisma / XSOAR integration
   - **Analytics tuning** — ML-based detection configuration

3. **Analyze** — Apply Cortex XDR-specific reasoning. Understand that XDR's core value is cross-domain correlation — correlating endpoint, network, and cloud events into unified incidents.

## Cortex XDR Architecture Overview

**Core components:**
- **Cortex XDR Agent** — Endpoint agent for Windows, macOS, Linux. Collects telemetry and enforces policy.
- **Cortex XDR Management Console** — Cloud-hosted web console (`cortex.paloaltonetworks.com`)
- **XDR Backend** — Cloud processing engine for event correlation and ML-based Analytics detections
- **Causality Chain** — Automatic attack chain reconstruction (similar to SentinelOne Storyline)
- **Data Lake** — Unified storage for endpoint + network + cloud telemetry (Cortex Data Lake)

**Integration with Palo Alto ecosystem:**
- **Palo Alto NGFW** — Network telemetry (firewall logs, threat logs) fed to Cortex XDR
- **Prisma Cloud** — Cloud workload telemetry
- **XSOAR** — SOAR orchestration (playbooks triggered by XDR incidents)
- **Cortex XSIAM** — Full SOC platform including XDR + SIEM + SOAR + MXDR
- **AutoFocus** — Threat intelligence integration

## Agent Deployment

### Windows Installation

```powershell
# Install Cortex XDR Agent
.\cortex_xdr_agent_installer.exe /silent /mode=endpoint /proxy=proxy.corp.com:8080

# Verify installation
Get-Service -Name "CortexXDR" | Select Status
# Status: Running

# Check agent version
Get-ItemProperty "HKLM:\SOFTWARE\Palo Alto Networks\Cortex XDR" | Select Version
```

### Linux Installation

```bash
# RPM-based
sudo rpm -ivh cortex_xdr_agent.rpm

# DEB-based
sudo dpkg -i cortex_xdr_agent.deb

# Verify
sudo systemctl status cortex-xdr
sudo /opt/traps/bin/cytool runtime show
```

## XQL (XDR Query Language)

XQL is Cortex XDR's query language for threat hunting across endpoint and network telemetry.

### XQL Syntax Fundamentals

```xql
-- Basic query structure
dataset = xdr_data
| filter event_type = ENUM.PROCESS and
  actor_process_image_name = "powershell.exe"
| fields actor_process_image_name, actor_process_command_line, causality_actor_process_image_name, hostname, _time
| sort desc _time
| limit 100
```

**Key operators:**
- `filter` — WHERE clause equivalent
- `fields` — SELECT specific columns
- `sort` — ORDER BY
- `limit` — LIMIT rows
- `dedup` — Deduplicate on fields
- `comp count()` — Aggregate count
- `join` — Join datasets
- `union` — Combine datasets

**Pattern matching:**
```xql
-- Contains substring
actor_process_command_line ~= ".*-enc.*"

-- Starts with
actor_process_image_path ~= "C:\\Windows\\System32.*"

-- Case insensitive match
lowercase(actor_process_image_name) = "powershell.exe"

-- IN list
actor_process_image_name in ("cmd.exe", "powershell.exe", "wscript.exe")
```

### Key XQL Datasets

| Dataset | Description |
|---|---|
| `xdr_data` | All endpoint events |
| `xdr_alerts` | Generated alerts |
| `cloud_audit_logs` | Cloud provider audit events |
| `firewall_traffic` | NGFW traffic logs (if integrated) |
| `dns_security` | DNS Security events (NGFW) |
| `url_logs` | URL filtering logs (NGFW) |

### Core XQL Hunting Queries

**Suspicious PowerShell:**
```xql
dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter actor_process_image_name = "powershell.exe"
| filter actor_process_command_line ~= ".*(-enc|-nop|bypass|hidden|invoke-expression|iex).*"
| fields hostname, actor_username, actor_process_command_line, causality_actor_process_image_name, _time
| sort desc _time
```

**Office spawning shell processes:**
```xql
dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter causality_actor_process_image_name in ("WINWORD.EXE", "EXCEL.EXE", "OUTLOOK.EXE", "POWERPNT.EXE")
| filter actor_process_image_name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe")
| fields hostname, actor_username, causality_actor_process_image_name, actor_process_image_name, actor_process_command_line, _time
| sort desc _time
```

**LSASS memory access:**
```xql
dataset = xdr_data
| filter event_type = ENUM.CROSS_PROCESS
| filter target_process_image_name = "lsass.exe"
| filter actor_process_image_name not in ("services.exe", "wininit.exe", "svchost.exe", "csrss.exe", "MsMpEng.exe", "CortexXDR.exe")
| fields hostname, actor_username, actor_process_image_name, actor_process_command_line, _time
| sort desc _time
```

**DNS to rare domains:**
```xql
dataset = xdr_data
| filter event_type = ENUM.NETWORK
| filter event_sub_type = ENUM.DNS_QUERY
| comp count() as query_count by dns_query_name, hostname
| filter query_count <= 3
| sort asc query_count
| limit 50
```

**Lateral movement via SMB:**
```xql
dataset = xdr_data
| filter event_type = ENUM.NETWORK
| filter dst_port = 445
| filter action_remote_ip not in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") or (comp count() as hosts by src_ip | filter hosts > 10)
| comp count() as connection_count, dc(action_remote_ip) as unique_targets by hostname, actor_process_image_name
| filter unique_targets > 5
| sort desc unique_targets
```

## BIOC (Behavioral IOC) Rules

BIOC rules define custom behavioral detection logic based on event sequences.

### BIOC Rule Structure

BIOC rules are created in the Cortex XDR console under: Incident Response > BIOC Rules

**Rule components:**
- **Filter**: Conditions that must match the event
- **Sequence**: Multi-event sequences (optional)
- **Exceptions**: Conditions that suppress the alert
- **Severity**: Informational / Low / Medium / High / Critical
- **MITRE ATT&CK tag**: For mapping

### BIOC Rule Examples

**Single-event BIOC (certutil download):**
```
Rule Name: Certutil URL Download
Event Type: Process Execution
Filter:
  AND actor_process_image_name = "certutil.exe"
  AND actor_process_command_line contains "-urlcache"
  AND (actor_process_command_line contains "http" OR actor_process_command_line contains "ftp")
Severity: High
ATT&CK: T1140, T1105
```

**Multi-event BIOC (Office macro → network connection):**
```
Rule Name: Office App Making External Network Connection After Macro
Sequence:
  Event 1: Process Execution
    AND actor_process_image_name in (WINWORD.EXE, EXCEL.EXE, OUTLOOK.EXE)
  
  Event 2 (within 60s of Event 1): Network Connection
    AND causality_actor_process_image_name in (WINWORD.EXE, EXCEL.EXE, OUTLOOK.EXE)
    AND NOT action_remote_ip in ("CORP_IP_RANGES")
Severity: High
```

### BIOC vs. Analytics Detections

| Type | Mechanism | When to Use |
|---|---|---|
| BIOC | Rule-based event matching | Known technique patterns, specific IOA |
| Analytics | ML-based behavioral baseline anomaly | Novel/unknown behavior, statistical anomalies |
| IOC | Hash/IP/domain indicators | Known-bad artifacts |

## Analytics Detection Engine

Cortex XDR's Analytics engine uses ML models trained on behavioral baselines to detect anomalous activity without predefined rules.

### Analytics Alert Types

- **Credential-based anomaly**: Unusual authentication patterns for a user
- **Network-based anomaly**: Unusual network communication patterns
- **Process-based anomaly**: Process behavior deviating from learned baseline
- **Cloud-based anomaly**: Unusual API calls or resource access in cloud

### Analytics Tuning

Analytics alerts can be tuned to reduce false positives:

1. Navigate to: Incident Response > Analytics ML Models
2. For each model generating false positives:
   - Review "Baseline" to understand what normal behavior looks like
   - Add exceptions for known-good behavior patterns
   - Adjust sensitivity thresholds (per model)
3. Mark false positive alerts with feedback to improve model accuracy

## Causality View (Attack Chain Investigation)

Causality View is Cortex XDR's attack chain visualization, similar in concept to CrowdStrike's process tree and SentinelOne's Storyline.

### What Causality View Shows

The causality view is a directed graph showing:
- **Causality actor** — The root of the attack chain (entry point process)
- **Actor processes** — Processes in the attack chain
- **Events** — Files written, network connections, registry changes, by each process
- **Timeline** — Chronological view of the entire chain

### Investigation Workflow

1. Navigate to: Incident Response > Incidents
2. Click an incident
3. Navigate to **Causality View** (or "Investigation" tab)
4. Review the causality graph:
   - Start at the leftmost (root) node
   - Follow chains to identify the attack path
   - Click each node for detailed event info
5. Use **Timeline view** for chronological context
6. Check **Network Map** for lateral movement visualization (if multi-endpoint incident)

### Stitch (Cross-Domain Correlation)

Cortex XDR "stitches" events from different domains into a single incident:

Example correlated incident:
```
Email (Defender for Office integration):
  → Phishing email received (email telemetry)

Endpoint:
  → outlook.exe spawned powershell.exe (endpoint telemetry)
  → powershell.exe wrote malware.exe (endpoint telemetry)
  → malware.exe connected to C2 IP (endpoint telemetry)

NGFW:
  → C2 IP blocked by PAN URL filter (network telemetry)

Result: Single incident combining all 4 events across 3 data sources
```

## Live Terminal

Live Terminal provides interactive remote shell access to endpoints (requires agent with Live Terminal support).

### Live Terminal Commands

```bash
# Connect to endpoint from Cortex XDR console:
# Navigate to: Endpoint Management > Endpoints > Actions > Live Terminal

# System info
sysinfo

# List processes
ls -proc

# List network connections
ls -net

# List files in directory
ls C:\Windows\Temp\

# Get file (download to console)
getfile C:\Windows\Temp\suspicious.exe

# Kill process
kill 1234

# Run script on endpoint
execscript -script_name "my_script" -timeout 60

# Isolate endpoint (network quarantine)
isolate
```

## IOC Management

### Supported IOC Types

- File hash (MD5, SHA256)
- IP address
- Domain
- URL

### IOC Actions

- **Block** — Prevent (file execution, network connection)
- **Alert** — Generate alert on match
- **Whitelist** — Allow / suppress alerts

### Creating IOCs

1. Navigate to: Incident Response > Indicators
2. Click "Create new indicator"
3. Specify: Type, Value, Action, Severity, Expiry
4. Tag with MITRE ATT&CK technique and campaign name

**Bulk IOC import:**
```
Supports CSV import with columns:
type, value, action, severity, expiration_date, comment
```

## XSOAR Integration (SOAR Playbooks)

Cortex XDR integrates natively with Cortex XSOAR for automated response playbooks.

### Common XSOAR Playbooks for XDR

- **Cortex XDR Incident Handling** — Auto-enriches all XDR incidents, runs investigation steps
- **Malware Investigation** — Sandboxes suspicious files, generates IOCs, blocks across Palo Alto suite
- **Ransomware Response** — Isolates affected hosts, blocks C2 IPs on NGFW, notifies stakeholders
- **Phishing Investigation** — Correlates XDR endpoint alert with email telemetry

### Playbook Trigger Configuration

In XSOAR, XDR incidents flow in automatically via the Cortex XDR integration:
1. XSOAR > Settings > Integrations > Cortex XDR
2. Configure API key and XDR tenant URL
3. Enable "Fetch incidents"
4. Set incident classification/mapping
5. Assign playbook to incident type "Cortex XDR Incident"

## Key Differences: Cortex XDR vs. XSIAM

| Aspect | Cortex XDR | Cortex XSIAM |
|---|---|---|
| Focus | EDR + XDR (endpoint-first) | Full SOC platform (XDR + SIEM + SOAR + MXDR) |
| Log ingestion | Palo Alto products + limited third-party | Universal log ingestion (replaces SIEM) |
| SOAR | Integration with XSOAR | Built-in SOAR (ML-driven playbooks) |
| Analytics | EDR analytics + XDR correlation | Full SIEM-scale behavioral analytics |
| Target | Enterprise EDR buyer | SOC platform / SIEM replacement buyer |
| Use case | Endpoint + Palo Alto ecosystem protection | Full SOC modernization |

For organizations already investing heavily in the Palo Alto platform (NGFW + Prisma), XSIAM provides the most integrated experience. For endpoint-only or mixed-vendor environments, Cortex XDR provides the cross-domain correlation without replacing the SIEM.