Break Time with Cortex, Palo Alto Networks

### Overview In this presentation, Christine Kapka, a Cortex Systems Engineer at Palo Alto Networks, discusses how security operations teams can incorporate automation into their workflows using the Cortex XSOAR platform. Security Operations Centers (SOCs) face ongoing challenges such as alert overload, siloed tools, small team sizes, and the high time commitment required to investigate alerts manually. While automation is not a complete cure-all, Kapka demonstrates how XSOAR's playbooks and case management streamline alert triage, indicator enrichment, and repetitive tasks like routine vulnerability scan requests.

### Key Topics - **SOC Challenges**: Teams struggle with excessive alert volumes, navigating disparate interfaces across siloed products, and spending excessive time on repetitive, manual tasks. - **Indicator of Compromise (IOC) Enrichment**: Automated extraction and enrichment of indicators (IP addresses, URLs, hashes, and Active Directory user context) via modular playbooks and sub-playbooks. - **End-to-End Phishing Incident Response**: Automating complex phishing workflows, from user acknowledgement and email rasterization to indicator detonation, inbox hunting, and blocking malicious entities. - **Malware Investigation and Response**: Standardizing detection, indicator enrichment, analysis, and containment (such as endpoint isolation) across integrated tools. - **Operational Metrics and SOC Sustainability**: Demonstrating measurable time savings and improving analyst retention and work-life balance.

### Technical Details - **IOC Enrichment Workflow**: Kapka outlines a three-step model—Extract, Enrich, and Update. Alerts ingested from EDRs, SIEMs, or emails trigger playbooks that parse out IPs, hashes, and URLs. The playbook queries internal systems (DNS, Active Directory, endpoint tools) and external threat feeds (such as VirusTotal). If indicators are confirmed malicious, block lists and firewall watch lists are automatically updated; otherwise, the incident is closed or routed for analyst review. - **Phishing Response Automation**: Standard phishing workflows typically span 10 to 12 steps. In XSOAR, playbooks ingest the alert, automatically email the reporting user, rasterize the email for visual review, and extract attributes. Attachments are detonated, reputations checked, and if found malicious, severity is escalated to critical. The system searches and purges the email across other organization mailboxes. While analysts can retain a manual confirmation step, investigation time drops from 40–45 minutes per alert down to seconds or minutes. - **Malware Investigation Pack**: Addresses tool fragmentation across SIEM, EDR, and threat intelligence. Built to support solutions like Cortex XDR, CrowdStrike, and Microsoft, the pack automates queries and enables direct containment actions, such as isolating endpoints without leaving the XSOAR interface. - **Real-World Impact and Internal Metrics**: - *Financial Services Customer*: Handled 730 phishing alerts per week; XSOAR automatically closed 430 due to deduplication and spam filtering, saving four analyst days per month on phishing alone. - *Palo Alto Networks Internal SOC*: Monitors 1.5 trillion events over 90 days across 10,000+ employees. XSOAR automated responses to 5,200 alerts, leaving only 800 requiring manual intervention.

### Takeaways Automating repetitive tier-one tasks dramatically cuts response times, prevents analyst burnout, and supports staff retention. Palo Alto Networks leverages a "30-30-30" approach where analysts split time between alerts, investigations, and proactive projects, eliminating SOC turnover. Teams starting with automation can begin simply by centralizing case management and automating indicator enrichment to establish baseline metrics before expanding into automated containment.