What does Palo Alto Networks Cortex XDR do first when an endpoint is asked to run an executable?

Static analysis typically occurs after initial policy checks or as part of a deeper threat assessment, rather than being the absolute first action upon an executable run request.

Palo Alto Networks Cortex XDR's initial step for an executable is to consult its execution policies, which immediately enforce rules for allowed or blocked applications. This policy check ensures rapid compliance with security configurations before any deeper analysis.

Sending an executable to WildFire for cloud-based analysis is a subsequent step, usually reserved for unknown or suspicious files that pass initial policy evaluations or require more extensive scrutiny.

Dynamic analysis, or sandbox detonation, is a resource-intensive process performed later in the security chain, generally for files that are deemed suspicious after preliminary policy and static analysis checks.