Incident timelines<\/a> are valuable because an investigation must distinguish what happened from what analysts inferred later. Preserve timestamps, source system, and evidence references for every important event.<\/p>\nExpand scope by entity, behavior, and infrastructure<\/h3>\n Use XQL or other queries in layers. Start with the most discriminating indicator, then broaden only as evidence supports it. This prevents the investigation from drowning in every event associated with a common user or widely used system process.<\/p>","protected":false},"excerpt":{"rendered":"
Cortex XDR investigation workflows begin after triage has established that an alert or incident deserves deeper analysis. The investigation has a different objective from triage: reconstruct what happened, determine the full affected scope, identify the root behavior or entry point, preserve evidence, and support a response decision that can withstand technical and management review. In Network Security Platforms, investigation has to cross control boundaries. Endpoint evidence may reveal the execution chain, firewall logs may show external communication, identity data may explain account use, and XDR correlation may connect activity that…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2177,2214],"tags":[],"class_list":["post-12075","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","category-palo-alto-networks"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t