{"id":124618,"date":"2021-02-01T09:00:41","date_gmt":"2021-02-01T17:00:41","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=124618"},"modified":"2021-02-01T08:22:20","modified_gmt":"2021-02-01T16:22:20","slug":"cortex-xdr-incident-scoring","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2021\/02\/cortex-xdr-incident-scoring\/","title":{"rendered":"Cortex XDR Gets Smarter with Stronger Insights and Broader Visibility"},"content":{"rendered":"

Supercharge your investigations with intelligent incident scoring, enhanced search visualization and support for the richest set of data sources ever.<\/em><\/p>\n

Today, we released Cortex XDR 2.7 and Cortex XDR Agent 7.3, which, together, deliver a huge set of highly anticipated features that speed up investigations and boost the defenses of the Cortex XDR endpoint agent. These new capabilities not only block fast-moving endpoint attacks and help you reduce the mean-time-to-respond (MTTR) to incidents, they help deliver, in conjunction with Cortex XSOAR<\/a>, an integrated platform for all your SecOps needs.<\/p>\n

Incident Scoring Lets You Focus on What Matters<\/h2>\n

Security teams face today an endless deluge of alerts \u2013 to the tune of 11,000 alerts per week<\/a> on average. Our innovative Incident Management feature, introduced in 2019, alleviates alert fatigue by grouping related alerts from multiple data sources into incidents, cutting the number of individual events to review by 98%.<\/p>\n

<\/a> In Cortex XDR 2.7, we\u2019ve taken Incident Management to the next level with the introduction of incident scoring. A highly sought-out feature for customers, incident scoring lets you rank and prioritize high-risk incidents to swiftly zero in on the most critical threats. You can create incident scores based on over a dozen alert attributes, including the users or hosts in an alert. To simplify rule creation, you can upload a list of high-priority assets. With incident scoring, you can quickly home in on incidents that involve sensitive servers, for example, or prioritize attacks targeting your executive leadership team.<\/p>\n

\"Incident<\/span><\/div>
Incident scores reveal high-risk threats.<\/figcaption><\/figure>\n

 <\/p>\n

Flexible Insights Supercharge Your Investigations<\/h2>\n

Collecting the right data is the first step for effective detection and response. But all too often, SOC analysts end up drowning in the expansive data lakes they\u2019ve built. To investigate threats, analysts need to quickly find the answers they\u2019re looking for and decipher investigative clues in a snap by reviewing charts rather than scrolling through neverending tables. Reducing incident response time requires better search<\/a> insights and more flexible queries.<\/p>\n

With Cortex XDR 2.7, the search for exceptional search is over. To better visualize search results, Cortex XDR automatically generates graphical histograms for every field in a query. New search options let you analyze more types of data, while query language enhancements, such as optional case-insensitive searches, let you hunt down threats with ease.<\/p>\n

You can now display search results using a wide array of charts and visualization options including:<\/p>\n