What you are evaluating
The endpoint agent and broader XDR analytics have different deployment and licensing considerations. Unit 42 managed detection and response is a separate service, not an automatic part of endpoint software.
A useful evaluation context
An evaluation fits teams comparing cross-domain investigations, including organizations already operating Palo Alto Networks security controls.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Endpoint prevention and detection modules provide host-level protection and evidence on supported devices.
- Cross-domain analytics correlate supported endpoint, network, cloud, identity and email information during investigations.
- Investigation and automation functions help analysts organize evidence and coordinate permitted response activities.
Where it fits in the work
- Define a concrete endpoint investigation question and confirm that the selected Cortex XDR configuration supplies the necessary records.
- Use an authorized training host to collect a benign baseline, then compare the relevant events and document remaining uncertainty.
- Review the evidence with the responsible owner, record any approved response and confirm that normal lab operation is restored.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
A training case combines a fabricated identity event with a benign process event on a lab host. The analyst documents whether the two observations can be connected using the selected configuration.
Evidence to look for
Preserve source timestamps, entity identifiers and the reasoning for the connection. Record missing context explicitly and use an approved manual handoff if the integration cannot supply it.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which agent versions and operating systems support the exact response actions needed in the pilot?
- Which third-party data sources require additional ingestion, normalization work or separate licensed capabilities?
- How will investigators distinguish an observed relationship from an analytics-generated hypothesis in the case record?