XDR Best Practice Assessment

Details
Content
Dependencies
Version History

This content pack includes an incident type, custom fields, layout, and playbook to facilitate an XDR Best Practice Assessment for an existing deployment of Palo Alto Networks Cortex XDR Product. The assessment contains survey questions covering the following domains: Configurations, Agent Management, Policy and Profiles, Profile Extensions, Incident Management, and Incident Response. Answers to survey questions will be output to the incident layout along with best practice recommendations.

This content pack includes an incident type, custom fields, layout, and playbook to facilitate an XDR Best Practice Assessment for an existing deployment of Palo Alto Networks Cortex XDR Product.
The assessment contains survey questions covering the following domains: Configurations, Agent Management, Policy and Profiles, Profile Extensions, Incident Management, and Incident Response. Answers to survey questions will be output to the incident layout along with best practice recommendations.

Layouts

Name	Description
XDR Best Practice Assessment

Incident Fields

Name	Description
XDR BPA Agent Versions Recommendation
XDR BPA Malware Profile Recommendation
XDR BPA Access Management
XDR BPA Integrations
XDR BPA Agent Groups Recommendation
XDR BPA Broker VM
XDR BPA Deployment Strategy Recommendation
XDR BPA Agent Profile
XDR BPA Live Terminal
XDR BPA Malware Profile
XDR BPA Response Overview Recommendation
XDR BPA Response Overview
XDR BPA Device Control Recommendation
XDR BPA Agent VDI Flag
XDR BPA Content Versions Recommendation
XDR BPA Dashboards
XDR BPA Agent Versions
XDR BPA Alerting
XDR BPA Reports Recommendation
XDR BPA Restriction Profile Recommendation
XDR BPA Access Management Recommendation
XDR BPA Alert Exclusions
XDR BPA Exploit Profile Recommendation
XDR BPA Alerting Recommendation
XDR BPA Restriction Profile
XDR BPA Host Firewall Recommendation
XDR BPA Other Actions Recommendation
XDR BPA Exception Profile Recommendation
XDR BPA Host Isolation Recommendation
XDR BPA General Settings
XDR BPA Device Control Profile
XDR BPA Device Exceptions Recommendation
XDR BPA Deployment Strategy
XDR BPA Management Overview Recommendation
XDR BPA Integrations Recommendation
XDR BPA Agent Groups
XDR BPA Policy Strategy
XDR BPA Process Exceptions Recommendation
XDR BPA Reports
XDR BPA Host Isolation
XDR BPA Agent Install Packages
XDR BPA Exploit Profile
XDR BPA Agent VDI Flag Recommendation
XDR BPA Agent Profile Recommendation
XDR BPA Content Versions
XDR BPA Process Exceptions
XDR BPA Alert Exclusions Recommendation
XDR BPA Host Firewall
XDR BPA Management Overview
XDR BPA Live Terminal Recommendation
XDR BPA Exception Profile
XDR BPA Other Actions
XDR BPA Disk Encryption
XDR BPA Agent Install Recommendation
XDR BPA Policy Strategy Recommendation
XDR BPA General Settings Recommendation
XDR BPA Dashboards Recommendations
XDR BPA Broker VM Recommendation
XDR BPA Device Exceptions
XDR BPA Disk Encryption Recommendation

Incident Types

Name	Description
XDR Best Practice Assessment

Playbooks

Name	Description
XDR Best Practice Assessment	This playbook covers an XDR Best Practice Assessment for existing XDR deployments. It provides surveys for each domain of the assessment. The assessment covers the following domains: Configurations, Agent Management, Policy and Profiles, Profile Extensions, Incident Management, and Incident Response.

Incident Fields

Name	Description
XDR BPA Alert Exclusions Recommendation
XDR BPA Agent Versions
XDR BPA Integrations
XDR BPA Agent VDI Flag Recommendation
XDR BPA Response Overview Recommendation
XDR BPA Device Exceptions
XDR BPA General Settings
XDR BPA Agent VDI Flag
XDR BPA Access Management
XDR BPA Other Actions Recommendation
XDR BPA Device Control Recommendation
XDR BPA Integrations Recommendation
XDR BPA Alerting Recommendation
XDR BPA General Settings Recommendation
XDR BPA Management Overview Recommendation
XDR BPA Alert Exclusions
XDR BPA Management Overview
XDR BPA Process Exceptions
XDR BPA Live Terminal Recommendation
XDR BPA Exploit Profile
XDR BPA Disk Encryption Recommendation
XDR BPA Exception Profile
XDR BPA Exception Profile Recommendation
XDR BPA Device Exceptions Recommendation
XDR BPA Agent Profile Recommendation
XDR BPA Exploit Profile Recommendation
XDR BPA Alerting
XDR BPA Host Firewall
XDR BPA Agent Groups
XDR BPA Host Firewall Recommendation
XDR BPA Host Isolation Recommendation
XDR BPA Other Actions
XDR BPA Host Isolation
XDR BPA Agent Profile
XDR BPA Reports Recommendation
XDR BPA Agent Install Recommendation
XDR BPA Malware Profile
XDR BPA Policy Strategy Recommendation
XDR BPA Deployment Strategy
XDR BPA Disk Encryption
XDR BPA Agent Versions Recommendation
XDR BPA Device Control Profile
XDR BPA Process Exceptions Recommendation
XDR BPA Restriction Profile
XDR BPA Restriction Profile Recommendation
XDR BPA Content Versions Recommendation
XDR BPA Broker VM Recommendation
XDR BPA Dashboards Recommendations
XDR BPA Live Terminal
XDR BPA Access Management Recommendation
XDR BPA Policy Strategy
XDR BPA Broker VM
XDR BPA Malware Profile Recommendation
XDR BPA Dashboards
XDR BPA Response Overview
XDR BPA Agent Groups Recommendation
XDR BPA Content Versions
XDR BPA Agent Install Packages
XDR BPA Deployment Strategy Recommendation
XDR BPA Reports

Incident Types

Name	Description
XDR Best Practice Assessment

Playbooks

Name	Description
XDR Best Practice Assessment	This playbook covers an XDR Best Practice Assessment for existing XDR deployments. It provides surveys for each domain of the assessment. The assessment covers the following domains: Configurations, Agent Management, Policy and Profiles, Profile Extensions, Alert Management, and Alert Response.

Pack Name	Pack By
Base	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Supported By	Community
Created	August 30, 2022
Last Release	August 21, 2023

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.