PSE-Cortex Palo Alto Networks System Engineer - Cortex Professional Question and Answers

Before deploying Cortex XSOAR, it’s important to consider whether communication with internal or external applications is required. This ensures that integrations and data flows between Cortex XSOAR and other tools or systems in the environment can be properly configured, enabling seamless automation and orchestration of security operations.

Managed Threat Hunting combines world-class threat intelligence with Cortex XSIAM (Extended Security Intelligence and Automation Management) technology to help identify attackers. This service provides proactive threat hunting capabilities, allowing security teams to detect advanced threats and respond to potential attacks with the help of expert analysts and automated tools.

Correct

Cortex Xpanse uses continuous internet scanning to identify previously unknown assets. This feature allows the platform to continuously monitor the internet for new or unregistered assets that could be associated with an organization's network, providing real-time visibility into potential exposure or vulnerabilities.

The integration between Cortex Xpanse and Cortex XSOAR benefits security teams by enabling automatic incident response actions for internet-based incidents. This integration allows security teams to automate the detection, investigation, and response to threats identified through internet-facing assets, improving efficiency and reducing response time.

25 web pages

As a Palo Alto Cortex Professional, I’ll provide a detailed explanation for Question 165: Which Cortex XSIAM license is required if an organization needs to protect a cloud Kubernetes host? based on Palo Alto Networks’ documentation and licensing structure for Cortex XSIAM.

Correct Answer: D. Cortex XSIAM Enterprise Plus

Cortex XSIAM (Extended Security Intelligence and Automation Management) is an AI-driven security operations platform that unifies endpoint, network, cloud, and identity protection into a single solution. Protecting a cloud Kubernetes host involves securing containerized workloads in a Kubernetes environment, which requires specific capabilities such as agent-based or agentless detection, runtime protection, and integration with cloud-specific telemetry. Let’s evaluate the licensing options provided—A. Attack Surface Management, B. Cortex XSIAM Enterprise, C. Identity Threat Detection and Response, and D. Cortex XSIAM Enterprise Plus—to determine which one meets this requirement.

Cortex XSIAM Licensing Overview:

Cortex XSIAM offers tiered licensing plans, each providing different levels of functionality:

Attack Surface Management (ASM): Focuses on discovering and managing external attack surfaces (e.g., internet-facing assets). It does not include endpoint or cloud host protection capabilities like those needed for Kubernetes.

Cortex XSIAM Enterprise: The base tier that includes core SOC capabilities such as SIEM, XDR (endpoint detection and response), SOAR (security orchestration, automation, and response), and basic endpoint protection. It supports standard endpoint protection but lacks advanced cloud workload protection for Kubernetes.

Identity Threat Detection and Response (ITDR): An add-on or standalone module focused on detecting and responding to identity-based threats (e.g., credential misuse). It does not provide host-level protection for cloud environments like Kubernetes.

Cortex XSIAM Enterprise Plus: The highest tier, which extends the Enterprise license with advanced capabilities, including enhanced cloud workload protection for environments like Kubernetes, additional analytics packs, and broader data ingestion.

Kubernetes Protection Requirements:

Protecting a cloud Kubernetes host with Cortex XSIAM involves:

Agent-Based Protection: Deploying the Cortex XDR agent as a DaemonSet on Kubernetes nodes to monitor processes, network activity, and file events at the host and container levels.

Agentless Protection: Leveraging cloud telemetry and analytics for unmanaged Kubernetes clusters.

Cloud Workload Security: Detecting and responding to threats in containerized environments, which requires integration with Kubernetes-specific data (e.g., pod metadata, container runtime details).

Palo Alto Networks introduced Kubernetes-specific security features in Cortex XDR and XSIAM, including a specialized Linux agent and analytics packs for managed and unmanaged clusters. These capabilities are tied to advanced licensing tiers beyond the base Enterprise offering.

Option Analysis:

A. Attack Surface Management:

Purpose: Identifies exposed assets and vulnerabilities across the attack surface.

Relevance: While useful for visibility into external risks, ASM does not provide runtime protection or agent deployment for Kubernetes hosts.

Conclusion: Incorrect. It lacks the necessary endpoint and cloud protection features.

B. Cortex XSIAM Enterprise:

Purpose: Provides core XDR, SIEM, and SOAR functionality with endpoint protection for standard hosts (e.g., Windows, Linux).

Relevance: Includes the Cortex XDR agent for basic endpoint protection but does not explicitly cover advanced cloud workload protection for Kubernetes. The Enterprise tier is designed for general SOC operations and lacks the specialized Kubernetes analytics and licensing required for cloud hosts.

Conclusion: Incorrect. It’s insufficient for Kubernetes-specific protection.

C. Identity Threat Detection and Response:

Purpose: Focuses on identity-based threat detection (e.g., monitoring user behavior, credential attacks).

Relevance: ITDR is unrelated to host-level protection for Kubernetes. It addresses a different threat vector (identity) rather than cloud workload security.

Conclusion: Incorrect. It does not meet the requirement.

D. Cortex XSIAM Enterprise Plus:

Purpose: Extends the Enterprise tier with advanced features, including enhanced cloud detection and response (CDR), support for cloud workloads (e.g., Kubernetes, VMs), and additional analytics packs.

Relevance: The Enterprise Plus license includes the necessary capabilities for protecting cloud Kubernetes hosts. It supports the Cortex XDR agent for Kubernetes (deployed as a DaemonSet) and integrates agentless detection for cloud environments. Documentation highlights that advanced cloud protection, such as for Kubernetes, requires this higher tier, often tied to the “Cloud per Host” licensing model within XSIAM.

Conclusion: Correct. This license provides the required functionality.

Licensing Nuance:

For Cortex XDR (a component of XSIAM), protecting a Kubernetes host requires a Cortex Cloud per Host license, which is distinct from the standard Pro per Endpoint license. Within the XSIAM framework, this cloud-specific protection is bundled into the Enterprise Plus tier, which encompasses advanced cloud security features beyond what’s available in the base Enterprise license. The Enterprise Plus tier ensures compatibility with Kubernetes environments through both agent-based and agentless approaches, as outlined in Palo Alto Networks’ Kubernetes security enhancements.

To automate the response to certain alerts in Cortex XSIAM, playbook triggers should be configured. Playbooks allow automated workflows to be executed based on specific conditions or alerts, enabling faster and more consistent responses to security events.

The best place to find official resource material for a product or solution is typically the Administrator’s guide. It contains authoritative, comprehensive, and up-to-date information on setup, configuration, troubleshooting, and best practices directly from the product's vendor.

A clear understanding of a customer’s technical expertise helps post-sales teams customize their support and training efforts to match the customer's knowledge level. This ensures that the customer receives the appropriate guidance, training, and resources needed to effectively use the product or solution after the sale.

If a prospective customer is unable to run a product evaluation, Tech Rehearsal can be used to showcase Cortex XDR. A Tech Rehearsal provides a guided demonstration of the product's capabilities and features, allowing the customer to gain a deeper understanding of how it works in their environment without a formal evaluation.

Cortex Data Lake (now known as Strata Logging Service in some contexts, but still referred to as Cortex Data Lake for XDR purposes) is the cloud-based storage solution that supports Cortex XDR by storing endpoint telemetry, logs, and analytics data. The customer’s storage needs depend on the number of Cortex XDR clients, the subset forwarding data, the retention period, and the type of data stored (e.g., higher fidelity logs for advanced analytics). Let’s break down the problem step-by-step to determine the new storage requirement.

Initial Configuration:

Total Cortex XDR Clients: 300

Clients Forwarding Cortex XDR Data: 300 (all clients are forwarding data)

Retention Period: 30 days

Additional Requirement: Storage for higher fidelity logs to support Cortex XDR advanced analytics

Initial Storage Ordered: 2 TB

This configuration implies that 2 TB was sufficient to support 300 clients, all forwarding data, with a 30-day retention period, including the additional storage needed for advanced analytics logs.

New Configuration:

Total Cortex XDR Clients: 1,000

Clients Forwarding Cortex XDR Data: 300 (unchanged from the initial setup)

Retention Period: 30 days (unchanged)

Additional Requirement: Storage for higher fidelity logs to support Cortex XDR advanced analytics (unchanged)

The key change is the increase in total Cortex XDR clients from 300 to 1,000, but the number of clients forwarding data remains 300, and the retention period and analytics requirements are unchanged. We need to determine how this affects the storage requirement.

Cortex Data Lake Storage Sizing for Cortex XDR:

Palo Alto Networks provides sizing guidelines for Cortex Data Lake based on the number of endpoints forwarding data, the retention period, and the type of data stored. The storage requirement is primarily driven by:

Clients Forwarding Data: Only the endpoints actively sending telemetry to Cortex Data Lake (e.g., Cortex XDR Pro endpoints with enhanced data collection) contribute significantly to storage needs.

Retention Period: The number of days data is retained directly scales the storage requirement.

Data Type: Higher fidelity logs for advanced analytics (e.g., XDR Pro features like behavioral analytics) increase storage per endpoint compared to basic logs.

Cortex XDR Prevent: Provides basic endpoint protection with minimal data forwarding (e.g., alerts only), typically included in a 30-day retention baseline with minimal storage impact.

Cortex XDR Pro: Includes enhanced endpoint data collection (e.g., process execution, network activity) for advanced analytics, significantly increasing storage needs when enabled.

The problem states that all 300 initial clients were forwarding data, and the same 300 continue to do so in the new setup, with support for advanced analytics. This suggests these are likely Cortex XDR Pro clients, as Pro is required for full telemetry and analytics capabilities.

Storage Calculation:

Palo Alto Networks doesn’t publish exact per-endpoint storage figures publicly, but we can infer the requirement from the initial configuration and industry benchmarks:

Initial Setup (300 Clients, 30 Days, 2 TB):

2 TB supports 300 clients forwarding data for 30 days with advanced analytics.

Per client, this approximates to:2 TB÷300 clients=0.00667 TB/client2 \, \text{TB} \div 300 \, \text{clients} = 0.00667 \, \text{TB/client} 2TB÷300clients=0.00667TB/client or 6.67 GB per client for 30 days with higher fidelity logs.

This aligns with typical XDR Pro storage estimates, where enhanced data collection (e.g., 5-10 GB per endpoint per 30 days) is common depending on activity levels and analytics features.

New Setup (1,000 Total Clients, 300 Forwarding, 30 Days):

Clients Forwarding Data: Still 300, unchanged.

Retention: Still 30 days, unchanged.

Analytics Logs: Still required, unchanged.

Storage is driven by the 300 clients forwarding data, not the total number of clients. The additional 700 clients (1,000 - 300 = 700) are not forwarding data, suggesting they might be on Cortex XDR Prevent licenses or not fully activated for data collection, contributing negligible storage (e.g., only alerts, which are minimal).

Thus, the storage requirement remains:

300clients×6.67GB/client=2,001GB≈2TB

The recommended first step in planning a Cortex XDR deployment is to conduct an assessment and identify critical assets and endpoints within the environment. This ensures that the deployment is targeted and effective, focusing on the most critical parts of the infrastructure that are most likely to be attacked or compromised.

To ensure secure connectivity between the customer's network and the Cortex platform while adhering to compliance restrictions, the customer should use the Broker VM. The Broker VM acts as a secure intermediary between the local network and the Cortex platform, allowing for controlled and encrypted communication without directly exposing the network to the platform.