Cortex XDR 5.xCortex XDR 3.x

Built-in automations

Cortex XDR 5 introduces next-level functionality to your security operations with embedded automation, a native capability that integrates industry-leading automation directly into your workflow.

Transform Your Security Operations

Embedded automation helps you streamline operations, accelerate triage, and boost productivity. Cortex XDR 5 automation includes:

Pre-built and custom integrations: Connect with your existing tools and services to create seamless, end-to-end workflows.
Playbooks: Automate complex, multi-step tasks with procedures that query, analyze, and take action quickly and efficiently to respond to security threats. Use our pre-built playbooks, or create your own.
Automated quick actions: Instantly respond to threats with single-click commands, providing rapid resolution for common issues.
Automation rules: Automatically trigger playbooks or quick actions based on specific criteria, ensuring immediate, consistent, and proactive responses to your most critical threats.
Case investigation war rooms: Collaborate and act on threats in real-time, with all the necessary tools and automation in one place.

Previously-configured automation rules, established under Cortex XDR 4, will remain operational in their current state. However, the system prohibits both the editing of these legacy rules and the creation of any new rules using the legacy mechanism.

Users are advised to transition to the new playbook-based automation mechanism for all future configurations. Once the desired automations have been successfully established, it is strongly recommended that the legacy automation rules be disabled. This action is encouraged to eliminate unnecessary redundancy within the system.