Investigation and response

Investigation and response in Cortex Data Security provides a specialized toolset for uncovering and neutralizing risks to your sensitive data. Unlike traditional security workflows that focus on malware or host forensics, Cortex Data Security investigation is focused on the relationship between identities, cloud infrastructure, and data sensitivity. By understanding the "blast radius" of a potential threat, you can prioritize remediation for assets that contain your most critical information, such as PII or proprietary code.

Powering investigations with the Marketplace

Before you can effectively investigate your data environment, you must first enable the necessary integrations and automated workflows via the Marketplace. The Marketplace is a centralized content portal that lets you discover, install, and manage content packs in Cortex Cloud.

These packs support specific security orchestration use cases by bundling together the integrations, playbooks, scripts, and dashboards required to:

• Discover assets: Connect to cloud providers (AWS, Azure, GCP) to feed data into your Asset Graph.
• Remediate risks: Install pre-built playbooks to automate responses, such as notifying data owners via Slack or opening Jira tickets.

Note: For more information on discovering and managing content packs, see the Cortex Cloud Marketplace documentation.

Investigation and response tools

Once your environment is configured, you can use the following components to investigate and resolve data risks:

• Investigate issues: The central hub for reviewing data-security-specific violations, such as misconfigured storage buckets or exposed databases.
• Graph Search (Asset Graph): A visual tool to map the connections between identities and data, revealing the "attack paths" to sensitive assets.
• Asset investigation: Detailed "Asset Cards" that provide sensitivity levels, exposure status, and security history for any data resource.
• Cortex Assistant: A natural-language interface for asking complex questions like, "Which internet-exposed S3 buckets contain sensitive PII?"
• Automation and playbooks: Pre-built workflows to notify data owners or automatically revoke excessive permissions.
• XQL queries: Advanced granular searches across specialized Cortex Data Security datasets like ds_inventory and ds_findings.

Examples of investigation and response

• Remediating data exposure: Identifying an exposed production database and using the Action Center to immediately modify its resource policy.
• Identity risk assessment: Using Graph Search to identify all sensitive data assets accessible to a high-risk or compromised cloud user.

Note: For more information on these shared platform tools, see the Cortex Cloud Investigation and response documentation.