What is a benefit of ingesting and forwarding Palo Alto Networks NGFW logs to Cortex XDR?

Question

Options

• ASending endpoint logs to the NGFW for analysis
• BBlocking network traffic based on Cortex XDR detections
• CEnabling additional analysis through enhanced application logging
• DAutomated downloading of malware signatures from the NGFW

• A
  4% (1)
• C
  92% (23)
• D
  4% (1)

Explanation

Ingesting NGFW logs into Cortex XDR enriches the platform's data lake with detailed network telemetry, enabling deeper correlation and threat analysis - this is the core value of the integration, making C correct. The enhanced application logging visibility means Cortex XDR can correlate network events with endpoint activity for more accurate detections and investigations.

• A is wrong because the data flow is one-directional for this use case: NGFW logs go to Cortex XDR, not the other way around. Endpoint logs don't get sent back to the NGFW.
• B is wrong because while Cortex XDR can trigger responses, automatically blocking traffic on the NGFW based on XDR detections describes a separate enforcement/response mechanism (like firewall policy pushes), not a benefit of log ingestion itself.
• D is wrong because malware signature downloads are handled through Palo Alto's threat intelligence infrastructure (e.g., WildFire/AutoFocus), not as a function of log forwarding to Cortex XDR.

Memory tip: Think of Cortex XDR as a "data hungry analyst" - it receives logs from sources like NGFWs to analyze them more thoroughly. The benefit is always about richer analysis, not pushing data back or triggering downloads.

No community discussion yet for this question.