What is a benefit of ingesting and forwarding Palo Alto Networks NGFW logs to Cortex...

IntegratingPalo Alto Networks Next-Generation Firewalls (NGFWs)with Cortex XDR by ingesting and forwarding NGFW logs allows for enhanced visibility and correlation across network and endpoint data. NGFW logs contain detailed information about network traffic, applications, and threats, which Cortex XDR can use to improve its detection and analysis capabilities.

Correct Answer Analysis (C):Enabling additional analysis through enhanced application loggingis a key benefit. NGFW logs include application-layer data (e.g., App-ID, user activity, URL filtering), which Cortex XDR can ingest to perform deeper analysis, such as correlating network events with endpoint activities. This enhanced logging enables better incident investigation, threat detection, and behavioral analytics by providing a more comprehensive view of the environment.

Why not the other options?

A. Sending endpoint logs to the NGFW for analysis: The integration is about forwarding NGFW logs to Cortex XDR, not the other way around. Endpoint logs are not sent to the NGFW for analysis in this context.

B. Blocking network traffic based on Cortex XDR detections: While Cortex XDR can share threat intelligence with NGFWs to block traffic (via mechanisms like External Dynamic Lists), this is not the primary benefit of ingesting NGFW logs into Cortex XDR. The focus here is on analysis, not blocking.

D. Automated downloading of malware signatures from the NGFW: NGFWs do not provide malware signatures to Cortex XDR. Malware signatures are typically sourced from WildFire (Palo Alto Networks’ cloud-based threat analysis service), not directly from NGFW logs.

Exact Extract or Reference:

TheCortex XDR Documentation Portalexplains NGFW integration: “Ingesting Palo Alto Networks NGFW logs into Cortex XDR enables additional analysis through enhanced application logging, improving visibility and correlation across network and endpoint data” (paraphrased from the Data Ingestion section). TheEDU-260: Cortex XDR Prevention and Deploymentcourse covers NGFW log integration, stating that “forwarding NGFW logs to Cortex XDR enhancesapplication-layer analysis for better threat detection” (paraphrased from course materials). ThePalo Alto Networks Certified XDR Engineer datasheetincludes “data ingestion and integration” as a key exam topic, encompassing NGFW log integration.