> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/security-operations-and-response/network-detection-and-iot.md). # Network detection and IoT Learn how Cortex XDR detects network threats and provides visibility into IoT and unmanaged devices. ### Network detection and response Cortex XDR analyzes network telemetry with the same analytics engine it uses for endpoint and identity data. * **Palo Alto Networks firewalls and Prisma Access:** Traffic, threat, and URL logs, plus enhanced application logs (DNS, HTTP, and DHCP), provide deep network visibility. * **Third-party firewalls:** Logs from vendors such as Check Point, Fortinet, and Cisco ASA can feed analytics. For supported sources, connections are stitched into network stories. * **Detections:** For example, port scans and sweeps, beaconing to rare domains, suspicious RDP, SMB, and SSH sessions, and large uploads. See [Analytics alerts by data source](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source). See [Analytics sensors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-sensors) and How to map network events for analytics. ### Distributed sites For branch and store networks, forward firewall and SD-WAN logs to Cortex XDR through a Broker VM or a cloud integration. Use agents on supported endpoints, including Windows and Linux point-of-sale systems. ### IoT and unmanaged devices To see devices that can't run an agent, integrate Palo Alto Networks IoT Security. It ingests device inventory and IoT alerts. Firewall logs add traffic visibility for those devices. See [IoT Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/iot-security). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/security-operations-and-response/network-detection-and-iot.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.