View as single page Filter topics

Learn about Cortex XSIAM
Onboard Cortex XSIAM
Configure Cortex XSIAM
Protect your endpoints
- Endpoint security
  - Endpoint protection
    
    Malware protection
    
    Exploit protection
    
    File analysis and protection flow
    
    Endpoint protection capabilities
    
    Endpoint protection modules
    
    Processes protected by exploit security policy
    
    File Integrity Monitoring (FIM)
    
    CaaS Workloads
    
    WildFire analysis concepts
    
    Guidelines for keeping Cortex XDR agents and content updated
    
    About content updates
    
    Endpoint data collection
  - Install and manage endpoints
    
    Set up endpoint protection
    
    Set up endpoint profiles and exception rules
    
    Set up malware prevention profiles
    
    Set up exploit prevention profiles
    
    Set up agent settings profiles
    
    Set up restrictions prevention profiles
    
    Set up exception profiles and rules
    
    Exception configuration
    
    Issue exclusions
    
    Add an issue exclusion rule
    
    Add an IOC or BIOC rule exception
    
    Add a disable prevention rule for endpoints
    
    Add a disable injection and prevention rule
    
    Add a support exception rule for endpoints
    
    Add a legacy exception rule for endpoints
    
    Add a new exceptions security profile
    
    Add a global endpoint policy exception
    
    Set up Identity profiles
    
    Define endpoint groups
    
    Configure global agent settings
    
    Apply profiles to endpoints
    
    Create an agent installation package
    
    Manage an agent installation package
    
    Harden endpoint security
    
    Device control
    
    Host firewall
    
    Host firewall for Windows
    
    Host firewall for macOS
    
    Disk encryption
    
    Host Inventory
    
    Vulnerability Assessment
    
    Set a Cortex XDR agent Critical Environment version
    
    Set an application proxy for Cortex XDR agents
    
    Manage endpoint protection
    
    Move agents between managing servers
    
    Manage endpoint tags
    
    Set an alias for an endpoint
    
    Manage endpoint prevention profiles
    
    Upgrade Cortex XDR agents
    
    Restart agent
    
    Uninstall the Cortex XDR agent
    
    Clear agent database
    
    Delete Cortex XDR agents
    
    Manage agent tokens
    
    Retrieve support file password
    
    Send push notifications to iOS
    
    Monitor agent operational status
    
    Monitor agent activity
    
    Monitor agent upgrade status
- Endpoint DLP
Detect, investigate, and respond to threats
Reference and developer docs

Detect, investigate, and respond to threats / Cortex Advanced Email Security / Cortex Advanced Email Security module architecture and data flow

Cortex Advanced Email Security module architecture and data flow ↗

Abstract

The Cortex Advanced Email Security module, a cloud-native system, integrates multiple components to ingest, analyze, and respond to email-borne threats effectively.

The Cortex Advanced Email Security module is composed of several logical components, deployed in a cloud-native architecture. These components work together to ingest, analyze, and respond to email-borne threats.

Data collector

The data collector connects to the email platform via secure APIs to ingest message metadata, content, URLs, attachments, authentication verdicts, and user context (for example, group membership, privilege level). Collection occurs on a continuous basis with support for incremental deltas where applicable.

Detection engines

The module supports a multi-layered detection architecture composed of three distinct detection engines, each focused on a different analytical layer:

Artifact-based engine
- Analyzes discrete components embedded in the email such as file attachments and URLs.
- Leverages hash matching, sandbox integration (where available), and URL reputation systems to identify known or behaviorally malicious artifacts.
Metadata Analytics engine
- Evaluates risk based on email metadata, sender-recipient relationship history, header anomalies, and identity context (for example, VIP status, role, group associations).
- Detects impersonation, spoofing, newly seen senders, and anomalous communication patterns based on statistical baselining and heuristic rules.
- Surfaces signals associated with business email compromise (BEC), supply chain impersonation, and domain lookalikes.
LLM-based engine
- Processes the plain-text and HTML content of the email using large language models.
- Extracts semantic signals such as urgency, intent, emotional tone, and topic-based impersonation(for example, finance, HR, IT support).
- Feeds these high-level attributes into a broader social graph used to understand message deviation from historical tone and role-based communication patterns.
- Enhances detection of sophisticated phishing and text-only social engineering attacks that evade traditional signatures.

Issue processing and correlation layer

This layer normalizes output from the detection engines into a standardized issue format. It then correlates multiple issues into cases where shared indicators, for example, sender, URL, or theme, are identified. This layer also assigns a Score (using SmartScore) and enrichment metadata for downstream workflows.

Response engine

This engine executes response actions either automatically based on policy or manually via analyst intervention. It supports message removal, sender blocking, and false positive handling where platform permissions allow. All actions are logged with timestamp, executor, and result status.

User interface and admin console

The module includes a web-based management interface for the following:

Viewing Issues and case timelines
Investigating threat artifacts
Configuring detection policies
Managing exclusions and remediation rules
Monitoring dashboard statistics and risky user profiles

← Cortex Advanced Email Security module overview Getting started with the Cortex Advanced Email Security module →