Classification:

attack

Tactic:

TA0002-execution

Technique:

T1059-command-and-scripting-interpreter

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Monitor and respond to new incidents generated by Palo Alto Cortex XDR.

Strategy

Trigger notifications for any new incident generated by Palo Alto Cortex XDR. See [Triage Incidents][1] in the Cortex Help Center for more information.

Triage and response

1. Investigate the new incident details from here {{@xdr_url}}, focusing on the severity level {{@severity}}.
2. Notify the appropriate team for further analysis.
3. Adhere to organizational protocols to effectively address and mitigate the incident impact.

[1] https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Triage-Incidents