> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/what-is-cortex-xdr.md). # What is Cortex XDR? Cortex XDR sets a new standard in Extended Detection and Response (XDR) solutions, offering comprehensive protection, detection, and response capabilities. By analyzing data from the Cortex endpoint and various third-party sources, it effectively counters evolving threats in the cybersecurity landscape. Cortex XDR goes beyond traditional endpoint security, providing full visibility across network, endpoint, cloud, third-party, and identity sources. ![endpointscreen1-ezgif\_com-video-to-gif-converter.gif](/files/XRNn8Hur36vz7UjYCxEm) {% tabs %} {% tab title="Key features" %} * **Automation for enhanced efficiency**: Cortex XDR incorporates simplified automation actions, streamlining the investigative processes for security analysts and making them more efficient in threat response. * **Comprehensive visibility**: Unlike conventional solutions, Cortex XDR ensures complete visibility, not limited to the endpoint. It covers network, cloud, third-party, and identity sources, offering a holistic approach to threat detection. * **Reduced time to detect and respond**: Cortex XDR significantly reduces Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), enhancing overall incident response capabilities. * **Identity-focused threat detection**: Out-of-the-box identity-focused threat detection addresses initial access tactics, techniques, and procedures (TTPs). Additional add-ons are available for advanced identity-based threat detection analytics, like insider threats. * **Proven effectiveness**: Cortex XDR boasts impressive results from the MITRE ATT\&CK Round 4 Evaluation, achieving a 97% detection rate. * **Data science-driven detections**: Leveraging machine learning algorithms, Cortex XDR ensures true data science-driven detections, minimizing noise and improving efficacy, especially for hard-to-detect threats. * **Cloud-powered scalability**: Cortex XDR is designed to scale according to enterprise needs, harnessing the power of the cloud without on-premise solution requirements. * **Unified endpoint agent**: A unified endpoint agent is included, providing Next-Generation Antivirus (NGAV), Endpoint Detection and Response (EDR), host firewall, device control, disk encryption, and optional add-ons for forensic collection and host insights. {% endtab %} {% tab title="Security challenges addressed by Cortex XDR" %} Cortex XDR effectively tackles several security challenges faced by organizations today: * **Breaking down silos:** By delivering an integrated solution encompassing an endpoint agent, threat detection analytics, automation, identity threat detection, and forensic capabilities, Cortex XDR breaks down security solution silos. * **Continuous threat intelligence integration**: Cortex XDR addresses the challenge of outdated and fragmented threat intelligence by continuously integrating curated Unit 42 and Cortex threat research, providing clients with up-to-date insights. * **Balancing threat detection**: Cortex XDR mitigates the risk of missing both known and unknown threats, as demonstrated by third-party testing. It maintains a low signal-to-noise ratio, reducing false positives and relieving security analysts from chasing false flags. * **Increased ROI**: Cortex XDR offers an increased return on investment (ROI) compared to narrowly focused Endpoint Detection and Response (EDR) solutions and Security Information and Event Management (SIEM) solutions. It provides enhanced detection efficacy while minimizing the management burden on clients. * **Identity-based threat detection**: Cortex XDR stands out by addressing the rising concern of identity-based threats, covering insider threats, lateral movement, and anomalous user and entity behavior with the Identity Threat Detection and Response (ITDR) module. {% endtab %} {% tab title="Cortex XDR data flow" %} The following image describes the data collection, flow, and processing from various sources to Cortex XDR. ![Architecture\_diagram\_-\_xdr\_\_4\_.png](/files/Fe63QNCcFP2oHsIYrphR) Data sources are collected at the bottom of the chain and processed by on-premise servers and engines. Data is initially processed and analyzed using XQL, allowing for queries and analysis. The processed data is integrated with Virtual Machines, Forensics and AI analytics, ML models. This allows Cortex XDR to automate alerts and security. {% endtab %} {% endtabs %} XQL enables you to query for information contained in a wide variety of data sources in Cortex XDR/Cortex XSIAM for rigorous endpoint and network event analysis. The Palo Alto Networks Broker is a secured virtual machine (VM), integrated with Cortex XDR/Cortex XSIAM, that bridges your network and the Cortex product. By setting up the broker, you establish a secure connection in which you can route your endpoints, and collect and forward logs and files for analysis. Allows you to perform forensic analysis easily by collecting all the artifacts you need and displaying them in an intuitive forensics console. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/what-is-cortex-xdr.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.