Palo Alto Cortex XSIAM

The modern SOC must be built on a new architecture:

• Broad and automated data integration, analysis, and triage
• Unified workflows that enable analysts to be productive
• Embedded intelligence and automated response that can block attacks
  with minimal analyst assistance

Unlike legacy security operations, the modern SOC leads with massive datasets run by data science, rather than human judgment and rules designed to catch yesterday’s threats.

Cortex® XSIAM™ (extended security intelligence and automation management) unifies best-in-class functions, including endpoint detection and response (EDR); extended detection and response (XDR); security orchestration, automation, and response (SOAR); attack surface management (ASM); user and entity behavior analytics (UEBA); threat intelligence platform (TIP); and security information and event management (SIEM). Using a securityspecific data model and applying machine learning, XSIAM automates data integration, analysis, and triage to respond to most alerts. This enables you to focus on the incidents that require human intervention.

The data model is updated continuously with Palo Alto Networks threat intelligence gathered globally across tens of thousands of customers. XSIAM uses an ML-led design to integrate massive amounts of security data, aggregate alerts into incidents for automated analysis and triage, and respond to most incidents automatically. XSIAM is already proven in production, powering Palo Alto Networks own SOC and turning over a trillion events per month into a handful of analyst incidents per day.