Cortex XDR is Palo Alto Networks’ extended detection and response (XDR) platform that brings together data from endpoints, cloud, network, and identity sources to help security teams prevent, detect, and respond to modern cyberattacks.

Instead of relying on a single point solution, Cortex XDR reimagines threat detection by:

• Unifying data from the Cortex endpoint agent, cloud workloads, network traffic, and identity systems to provide full attack context, not just endpoint signals.
• Using AI and machine learning to deliver data science–driven detections that reduce noise and improve accuracy for hard-to-detect threats.
• Automating workflows and response so analysts can investigate and contain incidents faster and more consistently.

In independent MITRE ATT&CK Round 6 evaluations, Cortex XDR was the only endpoint security solution to achieve 100% technique detection with no configuration changes or delays, demonstrating its ability to catch both known and unknown threats while keeping false positives low.

Cortex XDR is designed to shorten both detection and response cycles by combining analytics, automation, and unified data.

Key improvements include:

• Faster detection: Mean time to detect (MTTD) is reduced to near-real time by correlating endpoint, cloud, network, and identity data and applying machine learning and UEBA (user and entity behavior analytics).
• Faster response: Mean time to respond (MTTR) is reduced to hours through built-in response playbooks and automated workflows that guide or execute containment and remediation steps.
• Lower noise: True data science–driven detections help maintain a strong signal-to-noise ratio, cutting down on false positives and letting analysts focus on real threats.

Because Cortex XDR runs in the cloud, it scales to enterprise needs without on-premises infrastructure, allowing teams to manage investigations and response centrally and consistently.

Cortex XDR provides a unified agent and analytics platform that covers prevention, detection, investigation, and response, with optional modules to deepen coverage where needed.

Core capabilities include:

• Next-generation antivirus: Blocks malware, ransomware, exploits, and fileless attacks.
• Endpoint protection: Device control, host firewall, and disk encryption to safeguard endpoints.
• Security analytics: Machine learning and UEBA-based detections across endpoint, cloud, network, and identity data.
• Detection and response: AI-driven analytics to pinpoint attacks and coordinate response actions.
• Threat intelligence integration: Continuous integration of curated Unit 42 and Cortex threat research, reducing the internal burden of threat intel and detection engineering.

Key add-ons and modules:

• Host Insights: Find vulnerabilities and sweep across endpoints to eradicate threats.
• Forensics Investigation: Collect and analyze comprehensive forensic evidence for faster root-cause analysis.
• Identity Threat Detection and Response (ITDR): Detect insider threats, lateral movement, and credential compromise, especially when paired with XDR Pro per Endpoint (includes eXtended Threat Hunting, or XTH).
• eXtended Threat Hunting (XTH): Collect rich endpoint data to support deep threat hunting operations.
• Managed Threat Hunting and Managed Detection and Response: 24/7 expert services from Unit 42 to discover, detect, and respond to advanced threats.

Cortex XDR also ingests third-party security logs (e.g., syslog, Kafka, databases, CSV, FTP, NetFlow, Windows events) and integrates with Prisma and IoT Security, helping organizations break down tool silos and improve ROI compared with narrowly focused EDR solutions.