![\"A](\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/12\/XDR.jpg\")
<\/p>\nThis is based on a true story. \u201cFred\u201d <\/b>did not depart from his employer with good intent: For years, he kept coming back and exfiltrating the company\u2019s intellectual property. The moment of truth came four years later, when the company deployed Cortex XDR.<\/b><\/p>\n
<\/p>\n
An IT admin for a large multinational American corporation, Fred had been let go four years prior. Knowing the IT group inside and out, he suspected that his ex-colleagues forgot to disable his VPN account. To test it, he used his VPN credentials from his private computer and surprise: He successfully logged in!<\/span><\/p>\n He knew his company\u2019s network very well. He also knew what he was looking for and where to find it. So, for the next four years, he kept coming back to exfiltrate the latest source code from the company\u2019s Git repositories.<\/span><\/p>\n <\/p>\n Logging in through VPN, he gained access to the VPN subnet. He now needed to get into a different subnet to access the Git repositories with the latest source code. He knew that an old Windows PC used for testing was still running and could provide a way to get there. Fred accessed the workstation with Microsoft\u2019s Remote Desktop and set up a PuTTY SSH tunnel to the Git server. He could now pass Git traffic from one subnet to another using the Windows PC as a proxy. He started to exfiltrate source code from the protected subnet, back to a server he\u2019d set up on the internet.<\/span><\/p>\n <\/p>\n When Cortex XDR\u2019s<\/a> machine learning (ML) engine was deployed, it was trained on network, cloud and endpoint events for a period of time to establish a baseline and identify the behavioral limits beyond which an alert is raised.<\/span><\/p>\n As soon as this initial training period was over, Cortex XDR\u2019s analytics confidently identified the uncommon tunneling process, declaring that the tunneling and RDP processes were abnormal behavior patterns on this network. Even though this behavior had been happening over the past four years, it was still recognized as suspicious: Cortex XDR\u2019s analytics not only compared behavior with past trends of the same entity but also to its peer group (in this case, other workstations).<\/span><\/p>\n <\/p>\n Cortex XDR also noted that the PC tunneling data between the internal network and a host on the internet was an unmanaged device (i.e., no Traps agent).<\/span><\/p>\n Machine learning starts with rich context. Our data science team\u2019s perspective on the topic is:\u00a0<\/span><\/p>\n \u201cIf we don\u2019t have enough data for analysis, we run the extra mile to collect it.\u201d<\/span><\/i><\/p>\n So, instead of alerting the SOC team prematurely at this point, Cortex XDR dispatched Pathfinder, its lightweight user-mode agent, to collect more data on the workstation and complete the partial analysis cycle. Not having an agent on the server isn\u2019t enough of an excuse to raise a half-baked alert and overload the SOC team with partial results, generating extra manual investigation tasks.<\/span><\/p>\n Pathfinder swiftly arrived, deployed and performed its data collection on the workstation. It took a snapshot of all running processes, all active incoming and outgoing network sessions, users logged in to the computer and uncommon domains in communication. As it collected data, it streamed the results to Cortex Data Lake<\/a> for Cortex XDR to finish up its analysis. It didn't take long for the ML engine to raise the flag:<\/span><\/p>\n <\/p>\n We heard this story shortly after the organization\u2019s SOC received the first alert from their brand-new Cortex XDR proof-of-concept. <\/span>And that is how this article was born.<\/span><\/p>\n <\/p>\n Beyond displaying Cortex XDR's ML models that adapt to each customer\u2019s environment, this story emphasizes how crucial rich data collection is across the network and endpoint. Cortex XDR\u2019s obsession with collecting missing data, combined with its holistic approach of stitching network and endpoint events together for rich context, results in better detection and deeper insight as well as ensures that our customers only see the alerts that matter.<\/span><\/p>\n The Cortex Data Science team's pledge to reduce your alert fatigue keeps driving us to create a world where each day is safer and more secure than the one before. Learn more about <\/b>Cortex XDR<\/b><\/a>.<\/b><\/p>\nMoving from VPN to Source Repositories via an SSH Tunnel<\/span><\/h2>\n
AI Wakes Up<\/span><\/h2>\n
Our Obsession with Data Leads to Fewer Alerts for the SOC<\/span><\/h2>\n
\n
![\"This](\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/12\/image1.png\")
<\/p>\nML and Holistic Thinking Wins<\/span><\/h2>\n