Blog
Palo Alto Networks
Security Orchestration Automation and Response

Palo Alto Networks

Security Orchestration Automation and Response

Playbook of the Week: Automating Response to Living-Off-the-Land (LOTL) Attacks

Organizations face increasingly sophisticated cyberattacks in today's rapidly evolving threat landscape. Attackers leverage common tools and living-Off-the-Land binaries (LOLBins) to blend in with typical network traffic. Defenders struggle to differentiate between benign and malicious actions in logs.

Playbook of the Week

Uncategorized

May 09, 2024

By Erez Felman Dar

Palo Alto Networks

Products and Services

Partners

Playbook of the Week

Playbook of the Week: Prisma Cloud Compute - Compliance Alert v2

Maintaining compliance with regulations and security standards is paramount for organizations in today's dynamic and ever-evolving cybersecurity landscape. However, simply receivin...

Apr 11, 2024

By Tomer Haimof

Playbook of the Week

Playbook of the Week: Streamlining Suspicious Data Upload Alert Investigati...

Data exfiltration refers to the unauthorized transfer of sensitive or confidential information from a network or system to an external location. This covert activity often occurs s...

Apr 05, 2024

By Tal Nossen

Playbook of the Week, Uncategorized

Playbook of the Week: Automating Management of XDR Identity Analytics Alert...

Identity analytics is a critical cybersecurity tool in combating the challenges posed by compromised user accounts and malicious insiders. Identity th...

Mar 07, 2024

By Omri Itzhak

Must-Read Articles, News and Events, Product Features

Unveiling the Power of Automation for MSSPs

Managed security service providers (MSSPs) face the same problems as any security operations team: disparate tools, siloed data sources and inconsistent processes.

Mar 01, 2024

By Bar Katzir

Announcement, Must-Read Articles, Product Features

XSOAR 8.5: What’s New

XSOAR 8.5 continues the evolution of XSOAR 8 which started with a SaaS platform and tight integration with the Cortex suite of products.

Feb 15, 2024

By Alon Yardeni

Playbook of the Week, Uncategorized

Playbook of the Week: Using YARA to Automate Malware Identification and Cla...

In the dynamic realm of cybersecurity, maintaining a proactive defense against evolving threats is non-negotiable. One potent weapon that has emerged...

Feb 01, 2024

By Yarden Altmann

Playbook of the Week

Playbook of the Week: Prisma Cloud Compute - Audit Alert v3

As applications are deployed across multiple clouds - public, private, hybrid - organizations are using a wide array of compute architectures. You have virtual machines (VMs), cont...

Jan 25, 2024

By Tomer Haimof

Playbook of the Week

Playbook of the Week: XSOAR Common Playbooks

As you embark on automating your security operations, determining which use cases to prioritize for automation can be a challenge. It requires careful consideration of your organization's unique threat landscap...

Jan 11, 2024

By Tal Nossen

Playbook of the Week

Introducing New XSOAR Capture the Flags!

Well, we have infused the fun element of the game into our capture the flag (CTF) content packs which take you on an interactive “treasure hunt” in Cortex XSOAR.

Dec 14, 2023

By Sasha Sokolovich

Playbook of the Week, Uncategorized

Bootstrap Your Threat Intel Management Program With Free Feeds and IOC Enri...

Getting your threat intel management (TIM) program up and running might seem like a daunting task. Picking the right feeds and enrichers can be challe...

Dec 07, 2023

By Dror Avrahami

Announcement, Playbook of the Week

Playbook of the Week: Streamlining the management of XDR Incidents

The new Cortex XDR Lite - Incident Handling playbook is a new addition to the Palo Alto Networks Cortex XDR - Investigation and Response content pack....

Nov 09, 2023

By Omri Itzhak

Announcement, Must-Read Articles, Product Features

XSOAR 8.4: What’s New

Earlier this year we announced our software as a service (SaaS) offering with the Cortex XSOAR 8 release. XSOAR 8 offers the benefits of tight integration with the industry-leading Cortex platform and its other cybersecurity products. In ad...

Oct 30, 2023

By Alon Yardeni

Playbook of the Week

Playbook of the Week: Unleash the Power of Identity Threat Intelligence wit...

When it comes to detecting identity-related threats, security teams need to distinguish between suspicious but benign activity and truly malicious activity. This can be challenging...

Oct 24, 2023

By Ido Van Dijk

Playbook of the Week

Playbook of the Week: Automating DLP Incident Feedback

In today's digital landscape, data loss prevention (DLP) solutions have become a critical component for keeping sensitive data secure in an organization. With an increasing amount of data being generated and sh...

Sep 07, 2023

By Tomer Haimof

Playbook of the Week

Playbook of the Week: Using CVEs in Incident Investigation

The Common Vulnerabilities and Exposures (CVE) repository is designed to provide a reference for a publicly known information security vulnerability. CVE identifiers, or CVEs, are...

Aug 03, 2023

By Dror Avrahami

Announcement, Must-Read Articles, Product Features, Use-Cases

Not in My Sandbox: Save Those Deployment Tears

Efficiency in a security operations center (SOC) is more than just ensuring security professionals are successfully responding to threats. A successful SOC works to maximize its op...

Jun 28, 2023

By Greg Smith

Playbook of the Week

Playbook of the Week: Automating Malicious File Detonation with Joe Securit...

The role of a security analyst has evolved significantly over the years, as the nature of cybersecurity threats have become increasingly sophisticated and complex. Today's security...

Apr 20, 2023

By Arad Carmi

Announcement, Must-Read Articles, Playbook of the Week

Playbook of the Week: Automated Rapid Response to 3CXDesktopApp Supply Chai...

A supply chain attack involving a software-based phone application called 3CXDesktopApp hit at the end of March.

Apr 06, 2023

By Jane Goh

Playbook of the Week

Playbook of the Week: Automating the Prioritization of Prisma Cloud Virtual...

Understanding and visualizing your cloud risks can be difficult to do. And, even if you have overcome those issues, the more data you collect often means more alerts and more work...

Mar 30, 2023

By Tomer Haimof

Must-Read Articles, News and Events, Playbook of the Week

Playbook of the Week: Automated Rapid Response to Microsoft Outlook for Win...

Automate Your Response to the Microsoft Outlook for Windows Vulnerability (CVE-2023-23397) On March 14th 2023, as part of Microsoft’s Patch Tuesday re...

Mar 21, 2023

By Ben Melamed

Load more blogs