The function of reputation scoring in the Threat Intelligence Module of Cortex XSIAM is to resolve conflicting scores from different vendors for the same indicator. This helps standardize threat intelligence, allowing the platform to provide a more accurate and reliable assessment of the risk associated with a given indicator, even when different sources may provide conflicting information.

Cortex Data Lake (now known as Strata Logging Service in some contexts, but still referred to as Cortex Data Lake for XDR purposes) is the cloud-based storage solution that supports Cortex XDR by storing endpoint telemetry, logs, and analytics data. The customer’s storage needs depend on the number of Cortex XDR clients, the subset forwarding data, the retention period, and the type of data stored (e.g., higher fidelity logs for advanced analytics). Let’s break down the problem step-by-step to determine the new storage requirement.

Initial Configuration:

Total Cortex XDR Clients : 300

Clients Forwarding Cortex XDR Data : 300 (all clients are forwarding data)

Retention Period : 30 days

Additional Requirement : Storage for higher fidelity logs to support Cortex XDR advanced analytics

Initial Storage Ordered : 2 TB

This configuration implies that 2 TB was sufficient to support 300 clients, all forwarding data, with a 30-day retention period, including the additional storage needed for advanced analytics logs.

New Configuration:

Total Cortex XDR Clients : 1,000

Clients Forwarding Cortex XDR Data : 300 (unchanged from the initial setup)

Retention Period : 30 days (unchanged)

Additional Requirement : Storage for higher fidelity logs to support Cortex XDR advanced analytics (unchanged)

The key change is the increase in total Cortex XDR clients from 300 to 1,000, but the number of clients forwarding data remains 300, and the retention period and analytics requirements are unchanged. We need to determine how this affects the storage requirement.

Cortex Data Lake Storage Sizing for Cortex XDR:

Palo Alto Networks provides sizing guidelines for Cortex Data Lake based on the number of endpoints forwarding data, the retention period, and the type of data stored. The storage requirement is primarily driven by:

Clients Forwarding Data : Only the endpoints actively sending telemetry to Cortex Data Lake (e.g., Cortex XDR Pro endpoints with enhanced data collection) contribute significantly to storage needs.

Retention Period : The number of days data is retained directly scales the storage requirement.

Data Type : Higher fidelity logs for advanced analytics (e.g., XDR Pro features like behavioral analytics) increase storage per endpoint compared to basic logs.

Cortex XDR Prevent : Provides basic endpoint protection with minimal data forwarding (e.g., alerts only), typically included in a 30-day retention baseline with minimal storage impact.

Cortex XDR Pro : Includes enhanced endpoint data collection (e.g., process execution, network activity) for advanced analytics, significantly increasing storage needs when enabled.

The problem states that all 300 initial clients were forwarding data, and the same 300 continue to do so in the new setup, with support for advanced analytics. This suggests these are likely Cortex XDR Pro clients, as Pro is required for full telemetry and analytics capabilities.

Storage Calculation:

Palo Alto Networks doesn’t publish exact per-endpoint storage figures publicly, but we can infer the requirement from the initial configuration and industry benchmarks:

Initial Setup (300 Clients, 30 Days, 2 TB) :

2 TB supports 300 clients forwarding data for 30 days with advanced analytics.

Per client, this approximates to: 2 TB÷300 clients=0.00667 TB/client2 \, \text{TB} \div 300 \, \text{clients} = 0.00667 \, \text{TB/client} 2TB÷300clients=0.00667TB/client or 6.67 GB per client for 30 days with higher fidelity logs.

This aligns with typical XDR Pro storage estimates, where enhanced data collection (e.g., 5-10 GB per endpoint per 30 days) is common depending on activity levels and analytics features.

New Setup (1,000 Total Clients, 300 Forwarding, 30 Days) :

Clients Forwarding Data : Still 300, unchanged.

Retention : Still 30 days, unchanged.

Analytics Logs : Still required, unchanged.

Storage is driven by the 300 clients forwarding data , not the total number of clients. The additional 700 clients (1,000 - 300 = 700) are not forwarding data, suggesting they might be on Cortex XDR Prevent licenses or not fully activated for data collection, contributing negligible storage (e.g., only alerts, which are minimal).

Thus, the storage requirement remains:

300clients×6.67GB/client=2,001GB≈2TB

Cortex Xpanse ingests public IP addresses from XDR endpoints. This allows the platform to monitor and track internet-facing assets, providing visibility into exposed assets and potential attack surfaces across the network.

The REST API allows a customer to integrate Cortex Xpanse with third-party applications, services, assets, and IP ranges while leveraging its investigation capabilities. The REST API provides programmatic access to Cortex Xpanse ' s features, enabling seamless integration with external systems for enhanced data exchange and analysis.

The ASM for Remote Workers module in Cortex Xpanse focuses on analyzing global scan data, identifying risky issues on remote networks, and providing internal insights. This helps organizations maintain visibility and control over the security of their remote workforce, ensuring that potential risks and vulnerabilities in remote network configurations are addressed proactively.

The Live terminal capability in Cortex XDR allows the immediate termination of an anomalous process or the entire process tree during the investigation of a security event. This feature helps analysts take swift action to stop potentially malicious activity on the endpoint in real-time.