> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/exposure-management.md).

# Exposure Management

Consolidate, prioritize, and remediate exposures across Palo Alto Networks and third-party data sources.

{% hint style="info" %}

### Notice

Requires the Exposure Management add-on.
{% endhint %}

Exposure Management in Cortex XDR is a collection of features, capabilities, integrations, and content designed to help defenders holistically assess, consolidate, prioritize, and proactively respond to exposures in their organization.

* **Comprehensive Visibility**

  Through a robust set of Cortex sensors and third-party integrations, along with the Cortex XDR data stitching and normalization engine, Exposure Management provides a normalized, deduplicated view of exposures across multiple different sources.
* **Actionable Prioritization**

  Exposure Management Precision Filtering, compensating control identification, and the Exposure Management Command Center enable defenders to view their risks through a number of different dimensions and start each day with only the most critical cases. Fix-oriented case grouping makes it easier to maximize the impact of security and IT team’s remediation efforts by identifying common remediation actions to address the largest number of prioritized vulnerabilities.
* **Automation-first Remediation**

  Platform automation capabilities and specialized exposure management content enable teams to augment their existing triage workflows, and in permissible situations, automate them entirely. Automation content comes ready out of the box to take actions such as:

  * Send notifications through a number of business and developer focused tools
  * Create tickets in third-party IT management software
  * Leverage AI-embedded remediation owner discovery
  * Take fully automated remediation actions through available control surfaces

## **Supported data sources**

Cortex Exposure Management gathers vulnerability data from the sources listed below.

**Palo Alto Networks sensors:**

* Cortex Agent
* Cortex Attack Surface Management
* Cortex Attack Surface Testing
* Cortex Cloud Agentless Scanner
* Cortex Container Registry Scanner
* Cortex Serverless Function Scanner
* Cortex Network Scanner

**Third party sensors (using built-in integrations):**

* Qualys VMDR
* Rapid7 InsightVM
* Tenable.io
* Tenable.sc
* Crowdstrike

**Third-party sensors (using the Vulnerability Ingest API):**

* Ingest vulnerabilities and related assets from any third-party scanner directly into your asset inventory and vulnerability management workflows.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/exposure-management.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.