CBTS XDR

Visibility

• CBTS XDR seamlessly integrates data collection from endpoints, networks, cloud environments, and identification data automatically and accurately. Cortex provides an unprecedented level of security visibility across the entire enterprise. Additionally, third-party alarms integrate with endpoint data streams to uncover root causes. These factors lead to streamlined resources and saved time for cybersecurity teams.

Threat detection

• CBTS XDR leverages machine learning to monitor behavior across endpoints and networks persistently, identifying unusual actions that may signal an attack. It offers a comprehensive perspective on users, incorporating risk scores based on user behavior analytics (UBA), thus enabling a 360-degree understanding of user activities.

Global analytics and insights

• The Global Analytics system of XDR utilizes insights from across its customer base to help you uncover sophisticated threats, including supply chain disruptions and zero-day exploits. By leveraging analytics across a comprehensive dataset, Cortex XDR can identify elusive threats that standalone endpoint, network, and cloud detection and response solutions often overlook.

Faster investigations

• Every occurrence documented in CBTS XDR offers a comprehensive overview of an attack, including essential artifacts and detailed threat intelligence. Additionally, XDR’s SmartScore utilizes machine learning to pinpoint high-risk incidents, enabling your team to evaluate the extent and impact of the attack swiftly.

Orchestration and automation

• CBTS has Cortex XSOAR integrated within our internal Cortex XDR platform, allowing our SOC team to automate responses by feeding incident data through over 900 product integrations. Our XSOAR playbooks are designed to automatically collect incidents from Cortex XDR, gather corresponding alerts, and modify incident fields within Cortex XDR. Additionally, it connects insights with incidents instantly, offering unparalleled insight into the worldwide threat environment and streamlining the dissemination of our threat intelligence on a large scale.

Secure USB device management

• The CBTS XDR agent stands out for its comprehensive defense capabilities against exploits, malware, ransomware, and fileless attacks. It features extensive exploit prevention modules designed to halt malware infections. Leveraging AI-powered analytics and deep insights into threats, it achieves precise detection. Additionally, it empowers rapid response and control over compromised devices.

Firewall and disk encryption

• Leverage host firewall and disk encryption features to enhance your security posture and meet compliance standards. The Cortex XDR host firewall allows you to manage incoming and outgoing traffic on Windows and MacOS devices. Disk encryption enables your team to establish guidelines and enforce BitLocker or FileVault encryption on your devices. The centralized Cortex XDR management console can easily manage these host firewall and disk encryption settings and policies.

Analytics and analysis

• CBTS XDR utilizes an AI-powered local analysis engine to scrutinize each file, constantly adapting to novel attack methods. By observing the behavior of various interconnected processes, its Behavioral Threat Protection engine detects attacks in real time. Moreover, its integration with the Palo Alto Networks WildFire malware analysis service enhances the system’s security precision and breadth.

Flexible response

• CBTS XDR empowers your security team to quickly neutralize threats across endpoints, networks, and cloud environments from a single interface. It halts the proliferation of malware, controls device network traffic, and updates blocklists, such as malicious domains, through seamless integration with enforcement points.

• Well-integrated functionality that exceeds visibility and operational efficiency benefits from point products.
• Playbooks and workflows that support prevention, detection, and response use cases, reducing the time needed to contain threats.
• Advanced analytics that leverages multiple sources of telemetry for relevant threat detection.
• Threat intelligence from a variety of sources — OEM, third-party intelligence sources, research groups, analysts, and cross-customer information.
• Increase the value of existing investments through configuration recommendations and best practice policies and actions.
• Integrations with ITSM tooling for ticketing.
• A measurable reduction in effort, time to detect, and time to remediate incidents.