> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-detection-and-response.md).

# Data Detection and Response

Data Detection and Response (DDR) detects and responds to threats against your data. It uses behavioral baselining and anomaly detection on top of data classification, ensuring each alert includes context about what was accessed, its sensitivity, and the data owner.

DDR baselines normal behavior for human and non-human identities and detects deviations across cloud, SaaS, and AI infrastructure. You can then respond to confirmed threats—for example, by revoking access, or escalating to the SOC.

## Enable DDR

To activate DDR capabilities, enable the analytics engine in **Settings → Configurations → Cortex Analytics**.

Note that the engine requires an activation period, typically 14 days of data from at least 30 entities, to establish an accurate behavioral baseline before it begins surfacing detections.

## View DDR Detections

DDR detections are driven by specialized analytics rules focused on data risks, such as mass downloads, risky data sharing, and ransomware behavior.

These rules are managed automatically to maintain a focused data-security experience. You can view analytics rules in **Threat Management → Detection Rules → Analytics Rules**, and you can view and manage all resulting detections within the **Cases and Issues** views. Detections are automatically tagged with 'DDR' to help you prioritize data-specific risks.

For a detailed description of each analytics alert, the behavior it identifies, and its required data sources, see the [Cortex Analytics Alert Reference](https://cortex-docs.paloaltonetworks.com/analytics-alerts/).

## Supported data sources for threat detection

DDR threat detection relies on continuous log ingestion from your cloud and SaaS environments. Once onboarded, these logs provide the raw data required by the Cortex Analytics engine to baseline normal user behavior and identify anomalies across your entire data estate, such as unauthorized data access or mass file downloads.

For detailed instructions on how to ingest logs from each data source, see the following articles:

* Cloud Audit Logs ([AWS](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-web-services.md), [GCP](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-cloud-platform.md), [Azure](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/azure-event-hub.md))
* [Google Workspace](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace.md)
* [Office 365 (OD, Sharepoint, Teams, MS Exchange)](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-office-365.md)
* [Box](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/box.md)
* [Dropbox](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/dropbox.md)
* [Salesforce](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/salesforce.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-detection-and-response.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.