> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr.md).

# Identity Threat Detection and Response (ITDR)

The Identity Threat Detection and Response (ITDR) add-on delivers comprehensive identity analytics and proactive posture management capabilities to secure organizational environments against identity-based threats. By integrating automated asset classification, behavior-based detection rules, and dynamic access policies, ITDR enables you to continuously monitor risk exposure, uncover anomalous activity, and enforce directory protections.

The ITDR add-on includes the following capabilities:

* [User Risk View](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/investigate-user-risk.md) which provides additional information about the asset for easy uncovering of hidden threats.
* [Risk Management Dashboard](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/monitor-user-risk-exposure.md) to help you review the risk exposure of the organization and enable faster decision making.
* Automated and customizable [Asset Role](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/asset-roles.md) classification based on constant analysis of the users in your network. You can edit and manage the User Asset Roles to meet the needs of your organization.
* Detection rules which monitor identity and authentication activity to identify identity-based threats, such as compromised accounts, privilege escalation, and anomalous access, and trigger issues when suspicious behavior is detected. See a complete list of the [Analytics rules](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/view-and-manage-analytics-rules.md).
* Dedicated view for quickly reviewing all identity related issues at a glance under **Modules** → **Identity Security** → **Issues → Threats**.
* Active Directory Security Posture Management (AD-SPM) which scans your infrastructure to uncover security vulnerabilities and misconfigurations, including weak and compromised passwords, across all identity types and provides targeted remediation steps. For more information, see [Improve Active Directory Posture with AD-SPM](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/active-directory-security-posture-management.md).
* Conditional Access Policy which enforces dynamic, context-driven access control by evaluating real-time authentication requests against user-centric security contexts and risk levels to immediately allow, block, or require multi-factor authentication. For more information, see [Enforce dynamic access control with CAP](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/conditional-access-policy.md).
* LDAP protection which analyzes and acts upon suspicious LDAP queries received by the Domain Controller, to detect and block Active Directory reconnaissance attacks. For more information, see [Prevent malicious LDAP queries](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/prevent-malicious-ldap-queries.md)**.**
* Remediation actions using the [Cortex Response and Remediation content packs](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack.md), a collection of automated playbooks that enable you to focus on high-priority threats while automating repetitive tasks.\
  For additional remediation capabilities, see the [Idira](https://www.paloaltonetworks.com/idira) documentation.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.