PSE-Cortex Palo Alto Networks System Engineer - Cortex Professional Questions and Answers

The REST API allows a customer to integrate Cortex Xpanse with third-party applications, services, assets, and IP ranges while leveraging its investigation capabilities. The REST API provides programmatic access to Cortex Xpanse's features, enabling seamless integration with external systems for enhanced data exchange and analysis.

Before requesting a Cortex XSOAR proof of value (POV) evaluation, it's important to gather a list of the different integrations that will need to be configured. This ensures that the POV can be tailored to the customer's environment and use cases, and allows the evaluation to be based on real-world data and workflows.

A clear understanding of a customer’s technical expertise helps post-sales teams customize their support and training efforts to match the customer's knowledge level. This ensures that the customer receives the appropriate guidance, training, and resources needed to effectively use the product or solution after the sale.

The feature in Cortex XSIAM that helps analysts reduce the noise and false positives typically seen in traditional SIEM systems is AI-generated correlation rules. These rules use machine learning to automatically identify meaningful patterns and reduce irrelevant alerts, helping analysts focus on the most critical incidents.

Audit users in Cortex XSOAR have limited, read-only access to the system, which allows them to view information without making any changes. Full users, on the other hand, have read-write access, meaning they can both view and modify incidents, configurations, and other system components.

Cortex Data Lake (now known as Strata Logging Service in some contexts, but still referred to as Cortex Data Lake for XDR purposes) is the cloud-based storage solution that supports Cortex XDR by storing endpoint telemetry, logs, and analytics data. The customer’s storage needs depend on the number of Cortex XDR clients, the subset forwarding data, the retention period, and the type of data stored (e.g., higher fidelity logs for advanced analytics). Let’s break down the problem step-by-step to determine the new storage requirement.

Initial Configuration:

Total Cortex XDR Clients: 300

Clients Forwarding Cortex XDR Data: 300 (all clients are forwarding data)

Retention Period: 30 days

Additional Requirement: Storage for higher fidelity logs to support Cortex XDR advanced analytics

Initial Storage Ordered: 2 TB

This configuration implies that 2 TB was sufficient to support 300 clients, all forwarding data, with a 30-day retention period, including the additional storage needed for advanced analytics logs.

New Configuration:

Total Cortex XDR Clients: 1,000

Clients Forwarding Cortex XDR Data: 300 (unchanged from the initial setup)

Retention Period: 30 days (unchanged)

Additional Requirement: Storage for higher fidelity logs to support Cortex XDR advanced analytics (unchanged)

The key change is the increase in total Cortex XDR clients from 300 to 1,000, but the number of clients forwarding data remains 300, and the retention period and analytics requirements are unchanged. We need to determine how this affects the storage requirement.

Cortex Data Lake Storage Sizing for Cortex XDR:

Palo Alto Networks provides sizing guidelines for Cortex Data Lake based on the number of endpoints forwarding data, the retention period, and the type of data stored. The storage requirement is primarily driven by:

Clients Forwarding Data: Only the endpoints actively sending telemetry to Cortex Data Lake (e.g., Cortex XDR Pro endpoints with enhanced data collection) contribute significantly to storage needs.

Retention Period: The number of days data is retained directly scales the storage requirement.

Data Type: Higher fidelity logs for advanced analytics (e.g., XDR Pro features like behavioral analytics) increase storage per endpoint compared to basic logs.

Cortex XDR Prevent: Provides basic endpoint protection with minimal data forwarding (e.g., alerts only), typically included in a 30-day retention baseline with minimal storage impact.

Cortex XDR Pro: Includes enhanced endpoint data collection (e.g., process execution, network activity) for advanced analytics, significantly increasing storage needs when enabled.

The problem states that all 300 initial clients were forwarding data, and the same 300 continue to do so in the new setup, with support for advanced analytics. This suggests these are likely Cortex XDR Pro clients, as Pro is required for full telemetry and analytics capabilities.

Storage Calculation:

Palo Alto Networks doesn’t publish exact per-endpoint storage figures publicly, but we can infer the requirement from the initial configuration and industry benchmarks:

Initial Setup (300 Clients, 30 Days, 2 TB):

2 TB supports 300 clients forwarding data for 30 days with advanced analytics.

Per client, this approximates to:2 TB÷300 clients=0.00667 TB/client2 \, \text{TB} \div 300 \, \text{clients} = 0.00667 \, \text{TB/client} 2TB÷300clients=0.00667TB/client or 6.67 GB per client for 30 days with higher fidelity logs.

This aligns with typical XDR Pro storage estimates, where enhanced data collection (e.g., 5-10 GB per endpoint per 30 days) is common depending on activity levels and analytics features.

New Setup (1,000 Total Clients, 300 Forwarding, 30 Days):

Clients Forwarding Data: Still 300, unchanged.

Retention: Still 30 days, unchanged.

Analytics Logs: Still required, unchanged.

Storage is driven by the 300 clients forwarding data, not the total number of clients. The additional 700 clients (1,000 - 300 = 700) are not forwarding data, suggesting they might be on Cortex XDR Prevent licenses or not fully activated for data collection, contributing negligible storage (e.g., only alerts, which are minimal).

Thus, the storage requirement remains:

300clients×6.67GB/client=2,001GB≈2TB

Cortex Data Lake (often referred to as Strata Logging Service in some contexts) is Palo Alto Networks’ cloud-based storage solution that centralizes security data for products like Cortex XDR, Prisma Access, and NGFWs. The question involves a customer who has activated a TMS (Tenant Management Service) tenant but has not purchased a Cortex Data Lake instance. TMS is part of the Palo Alto Networks ecosystem for managing tenants and services, typically associated with Cortex or Prisma deployments. Let’s break this down to determine the size of the free Cortex Data Lake instance provided in this scenario.

Understanding TMS and Cortex Data Lake:

TMS Tenant: The Tenant Management Service is a framework used to manage multiple tenants or instances within Palo Alto Networks’ cloud services (e.g., Cortex XDR, Prisma Access). Activating a TMS tenant implies the customer has initialized a management structure but hasn’t committed to a full Cortex Data Lake purchase.

Free Cortex Data Lake Instance: Palo Alto Networks provides a limited, free tier of Cortex Data Lake storage to customers who activate certain services or products, allowing them to evaluate functionality or store minimal data before committing to a paid license.

Free Storage Allocation:

When a customer activates a TMS tenant without purchasing a Cortex Data Lake instance, Palo Alto Networks allocates a default free storage capacity to enable basic functionality. According to official documentation and standard practices:

The free Cortex Data Lake instance provides 100 GB of storage.

This amount is intended for initial use cases, such as storing logs from a small number of endpoints (e.g., Cortex Xテゴ XDR Prevent agents), firewall logs, or trial data during evaluation periods.

Option Analysis:

A. 10 GB:

Analysis: 10 GB is too small to be a meaningful free tier for a product like Cortex Data Lake, which is designed to handle security telemetry from endpoints, networks, or cloud services. Even basic log storage for a few devices over a short period would exceed this quickly.

Conclusion: Incorrect.

B. 1 TB:

Analysis: 1 TB (1,000 GB) is a substantial amount of storage, typically associated with paid Cortex Data Lake subscriptions rather than a free tier. Offering this much for free would undermine the paid licensing model.

Conclusion: Incorrect.

C. 10 TB:

Analysis: 10 TB is even larger and aligns with enterprise-scale paid deployments, not a free instance. This size is far beyond what’s provided without a purchase.

Conclusion: Incorrect.

D. 100 GB:

Analysis: 100 GB is the documented size of the free Cortex Data Lake instance provided to customers who activate a tenant (e.g., via TMS) without purchasing additional storage. It’s sufficient for small-scale testing, such as storing logs from a handful of Cortex XDR agents or firewall data for a limited retention period (e.g., 30 days).

Conclusion: Correct.

Supporting Context:

Cortex XDR Example: For Cortex XDR Prevent customers, activating a tenant includes 100 GB of free Cortex Data Lake storage for 30 days of alert data (not full telemetry, which requires XDR Pro). This aligns with the TMS scenario, where basic tenant activation triggers the same free tier.

Prisma Access: Similarly, Prisma Access customers activating a tenant without a purchased Data Lake instance receive 100 GB for initial log storage.

Documentation: While exact wording may vary, Palo Alto Networks consistently references 100 GB as the free tier across product activation guides.

When integrating Cortex XSIAM or Cortex XDR with other Palo Alto Networks products, a XDR/XSIAM Broker VM is required. This Broker VM facilitates secure communication between the Cortex platform and other products, enabling proper integration and data exchange.

The Live terminal capability in Cortex XDR allows the immediate termination of an anomalous process or the entire process tree during the investigation of a security event. This feature helps analysts take swift action to stop potentially malicious activity on the endpoint in real-time.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html

The QuickStart service offering is designed for customers who need to rapidly deploy a solution like Cortex XSOAR. It provides a streamlined process for setting up the product, which is ideal for customers who have limited availability of internal resources due to other projects. QuickStart allows for a faster and more efficient implementation.

To enable endpoint and network analytics in Cortex XDR, the requirement is to have logs from at least 30 endpoints over a minimum of two weeks. This provides sufficient data for Cortex XDR to perform effective analytics and detection, helping identify trends and potential threats.

Premium Customer Success is an important part of any Cortex bill of materials because it offers expert-led configuration guidance. This ensures that customers can effectively set up and optimize the Cortex platform according to their specific needs and security requirements, helping them achieve the best results and reduce time to value.

When evaluating the effectiveness and ROI on cybersecurity planning and technology, it's important to consider people, security controls, mean time to detect (MTTD), and false positives. These factors help ensure that the security infrastructure is both efficient and effective in preventing, detecting, and responding to threats, while optimizing the overall cost and resource allocation.