Endpoint security

This section outlines how Cortex XSIAM, with its integration of the Cortex XDR agent, provides comprehensive protection for your endpoints. It details the key features and functionalities that enable you to prevent sophisticated attacks, rapidly detect and investigate threats, and automate response actions across all your endpoints, whether on-premises or remote.

Requires one of the following licenses

* Cortex XSIAM Premium
* Cortex XSIAM Enterprise
* Cortex XSIAM NG-SIEM with the Cloud Runtime Security add-on or the Enterprise Runtime Security add-on

Sub-topics

• Endpoint protection
  • Malware protection
  • Exploit protection
  • File analysis and protection flow
  • Endpoint protection capabilities
  • Processes protected by exploit security policy
  • File Integrity Monitoring (FIM)
  • CaaS Workloads
  • WildFire analysis concepts
  • Guidelines for keeping Cortex XDR agents and content updated
  • About content updates
  • Endpoint data collection
• Install and manage endpoints
  • Set up endpoint protection
    • Set up endpoint profiles and exception rules
      • Set up malware prevention profiles
      • Set up exploit prevention profiles
      • Set up agent settings profiles
      • Set up restrictions prevention profiles
      • Set up exception profiles and rules
        • Exception configuration
        • Issue exclusions
          • Add an issue exclusion rule
        • Add an IOC or BIOC rule exception
        • Add a disable prevention rule for endpoints
        • Add a disable injection and prevention rule
        • Add a support exception rule for endpoints
        • Add a legacy exception rule for endpoints
          • Add a new exceptions security profile
          • Add a global endpoint policy exception
      • Set up Identity profiles
  • Define endpoint groups
  • Configure global agent settings
  • Apply profiles to endpoints
  • Create an agent installation package
    • Manage an agent installation package
  • Harden endpoint security
    • Device control
    • Host firewall
      • Host firewall for Windows
      • Host firewall for macOS
    • Disk encryption
    • Host Inventory
    • Vulnerability Assessment
    • Set a Cortex XDR agent Critical Environment version
  • Manage endpoint protection
    • Move agents between managing servers
    • Manage endpoint tags
      • Create an endpoint tag
      • Remove an endpoint tag
      • Track your endpoint tags
      • Permanently remove Endpoint tags from the system
      • Set an alias for an endpoint
    • Manage endpoint prevention profiles
    • Create a new prevention policy rule for serverless function
    • View information about your endpoint prevention profiles
    • Upgrade Cortex XDR agents
    • Restart agent
    • Uninstall the Cortex XDR agent
    • Clear agent database
    • Delete Cortex XDR agents
    • Manage agent tokens
    • Retrieve support file password
    • Send push notifications to iOS
    • Monitor agent operational status
    • Monitor agent activity
    • Monitor agent upgrade status