> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/threat-response-center.md).
# Threat Response Center
The **Threat Response Center** in attack surface management (ASM) in Cortex Xpanse simplifies and streamlines your response to global attack surface threat events and zero-day exploits by aggregating the most important information about the threat and its impact on your organization in one place. From the Threat Response Center, you can accomplish the following:
* **Review a curated list of emergent and global threat events**, and quickly identify the events that impact your organization.
* **Research a threat event**. The Xpanse Security Research Team provides a threat summary, potential exploit consequences, previous exploit activity, and links to other reputable sources for additional information.
* **Assess the impact of a threat event on your organization**. Review a detailed list of the affected software, turn on relevant attack surface rules, identify relevant incidents and alerts, and see how the risk is distributed across your organization.
* **Build a Remediation Plan**. The Threat Response Center provides remediation guidance for each event, lists of relevant alerts and incidents by status and assignee, and click-throughs to incident and alert pages to begin remediation.
{% hint style="warning" %}
### Danger
You must have a role with Attack Surface Rules permission to access the Threat Response Center. When setting up Roles Based Access Control (RBAC), you can find Attack Surface Rules in the Incident Response component.
{% endhint %}
Which threat events are included in the Threat Response Center?
Typically, a threat event or emerging vulnerability is a critical or high-risk vulnerability that allows threat actors direct access to assets, leading to widespread impact across corporate networks. Devices and applications impacted by such vulnerabilities are at risk of exploitation remotely over the public-facing internet. These threats often allow threat actors to gain remote control of systems.
Cortex Xpanse considers the following questions when evaluating the level of risk of a threat event and whether to include it on the Threat Response Center:
* Is it a vulnerability without a patch?
* Is it a “Known Exploitable Vulnerability” that has been weaponized by threat actors?
* Can it be exploited remotely over the internet in an unauthenticated manner?
* Is a proof of concept readily available? Has active exploitation in the wild been reported?
* How widespread is the impact of the vulnerability? Does it impact many organizations or is limited to a certain section of the industry?
* Is the vulnerability in an application or device that is routinely targeted by attackers?
* Does it have a vendor severity rating of “Critical” or “High”? Does it have a CVSS score of 9 or higher?
* Are there geo-political factors in play? (For example, is an APT targeting groups or individuals from specific countries or regions?)
How often is the Threat Response Center updated?
Our security research team creates and updates threat events in the **Threat Response Center** page in the following situations:
* When a new threat event occurs and the security research team determines the event is critical enough to add to **Threat Response Center**.
* When new information is discovered for existing threat events. The information on a threat event page is updated frequently as a threat evolves and exploit details are made public.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/threat-response-center.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.