> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-engine.md). # Analytics engine Cortex XDR uses its Analytics Engine to examine logs and data retrieved from your sensors on the Cortex XDR tenants to build an activity baseline, and recognize abnormal activity when it occurs. The Analytics engine accesses your logs as they are streamed to the Cortex XDR tenant, including any firewall data, and analyzes the information as soon as it arrives. Cortex XDR triggers an Analytics issue when the Analytics Engine determines an anomaly. The Analytics Engine examines traffic and data from a variety of sources such as network activity from firewall logs, VPN logs (from Prisma Access from the Panorama plugin), endpoint activity data, Active Directory or a combination of these sources, to identify the endpoints and users on your network. After identifying the endpoints and the users, the Analytics Engine collects relevant details about each asset based on the information it obtains from the logs to create profiles. The Analytics Engine can detect threats from only network data or only endpoint data, but for more context when investigating an issue, we recommend using a combination of data sources. The Analytics Engine creates and maintains profiles to view the activity of the endpoint or user in context by comparing it to similar endpoints or users. The large number of profile types can generally be placed into one of three categories. * Peer Group profiles: A statistical analysis of an entity or an entity relation that compares activities from multiple entities in a peer group. For example, a domain can have a cross-organization popularity profile or per peer group popularity profile. * Temporal profiles: A statistical analysis of an entity or an entity relation that compares the same entity to itself over time. For example, a host can have a profile depending on the number of ports it accessed in the past. * Entity classification: A model detecting the role of an entity. For example, users can be classified as service accounts, and hosts as domain controllers. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-engine.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.