Security Operations

Playbook of the Week

Rapid Response to CVE-2025-31324: Mitigating SAP NetWeaver Visual Composer Exploitation

Protect against SAP NetWeaver's critical CVE-2025-31324 vulnerability with Cortex XSIAM's automated detection and response playbook for identifying and mitigating exploitation

Must-Read Articles

News and Events

Playbook of the Week

May 15, 2025

By Sasha Sokolovich

Security Operations

Must-Read Articles, News and Events, Playbook of the Week

What’s New for Cortex and Cortex Cloud (Apr ‘25)

Discover cutting-edge advancements in security ops with the latest Cortex releases. New features enhance threat prevention, platform coverage, automation, and attack surface tests for streamlined and robust sec...

May 05, 2025

By Scott Simkin

Playbook of the Week

Playbook Creation Reimagined: The Intuitive Approach to Security Automation

Continuing to innovate on our market-leading SOAR to simplify security operations, ensure ease of use in the adoption of automation.

May 01, 2025

By Alon Yardeni

Playbook of the Week

Creating an Automated Workflow for Account Lockout Resolution

This playbook automates and speeds up response to excessive user account lockouts, which could indicate a credential-based attack.

Apr 10, 2025

By Ido Van Dijk

Playbook of the Week, Uncategorized

Automating Response to Unauthorized Scheduled Task Executions

Discover how Cortex XSIAM automates detection and response to malicious scheduled tasks that reference external HTTP/FTP sources for improved security...

Apr 03, 2025

By Omri Itzhak

Playbook of the Week, Uncategorized

Automating Response to Unauthorized Tor Logins

The A Successful Login from Tor playbook in Cortex XSIAM enhances security teams’ ability to detect and respond to unauthorized access attempts using Tor. By automating identity verification, automated remediat...

Mar 27, 2025

By Arik Day

Playbook of the Week, Unkategorisiert

Automating Response to Suspicious Process Executions

This playbook automates the investigation and response to suspicious process executions triggered by a scheduled task.

Mar 20, 2025

By Omri Itzhak

Playbook of the Week

Automated Rapid Response to Suspicious Remote Scheduled Task Creation

This playbook automates the identification and remediation of persistent threats that leverage scheduled tasks to execute malicious payloads across endpoints.

Mar 13, 2025

By Omri Itzhak

Playbook of the Week, Product Features, Products and Services, Unit 42

Announcing Unit 42 Managed XSIAM — Redefining 24/7 Managed SecOps

Palo Alto Networks announces Unit 42 Managed XSIAM, a solution that provides 24/7 expert-led defense across every attack surface.

Mar 11, 2025

By Sharon Maydar

Playbook of the Week

Automating Response to Suspicious SaaS Access From a Tor Exit Node

This playbook shows how a SecOps team can use Cortex XSIAM to automate and speed response to suspicious SaaS access alerts involving a Tor exit node.

Mar 06, 2025

By Arik Day

Playbook of the Week, Uncategorized

Automating Response to Credential Dumping Attacks

Automated playbook designed to detect, contain and remediate credential dumping activity.

Feb 27, 2025

By Omri Itzhak

Playbook of the Week

Automating Response to Unauthorized User Account Creation

This playbook automates incident response actions to identify, investigate, and remediate unauthorized hidden user account creation.

Feb 20, 2025

By Ido Van Dijk

Playbook of the Week

SSO Password Spray Playbook

Learn how to detect and prevent SSO password spray attacks with our comprehensive security playbook. Automate response and strengthen authentication security.

Feb 13, 2025

By Karina Fishman

Playbook of the Week

Automating Response to Unauthorized User Privilege Escalations Using PowerS...

Automating response to unauthorized privilege escalation activity such as a user being added to local administrator group using a PowerShell command

Feb 05, 2025

By Omri Itzhak

Playbook of the Week

Automating Response to Multi-Factor Authentication Threats

SEO Meta description Cortex XSIAM automated playbook addressing user rejected numerous SSO MFA attempts

Jan 30, 2025

By Tomer Haimof

Playbook of the Week, Product Features

Automating Response to Unauthorized Email Forwarding Activity in Google Wor...

Automating response to “A mail forwarding rule was configured in Google Workspace” with Cortex XSIAM

Jan 28, 2025

By Arik Day

Playbook of the Week, Uncategorized

Automate Response to Event Log Clearing Alerts with Cortex XSIAM

Automating response to potentially malicious event logs clearing activity with Cortex XSIAM

Jan 16, 2025

By Sasha Sokolovich

Playbook of the Week, Product Features

Handling Successful SSO Sign-ins from Tor

Automating response to successful Tor SSO sign-ins with Cortex XSIAM

Jan 09, 2025

By Omri Itzhak

Playbook of the Week

An Automated Response to Malicious Pod Activity

Automated playbook for effectively tackling malicious activity within Kubernetes clusters.

Aug 15, 2024

By Ben Melamed

Playbook of the Week

Rapid Response for Fighting Ursa Phishing Campaign

Automated playbook to speed response to Russian threat actor, Fighting Ursa, APT phishing campaign offering diplomatic cars for sale.

Aug 08, 2024

By Ben Melamed

Playbook of the Week, Uncategorized

Playbook of the Week: Automating Response to Living-Off-the-Land (LOTL) Att...

Defend against stealthy LOTL attacks leveraging common tools and LOLBins. Cortex XDR automates detection, investigation, and remediation of suspicious...

May 09, 2024

By Erez Felman Dar

Load more blogs

Get the latest news, invites to events, and threat alerts

By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.

Security Operations

Playbook of the Week

Rapid Response to CVE-2025-31324: Mitigating SAP NetWeaver Visual Composer Exploitation

Security Operations

What’s New for Cortex and Cortex Cloud (Apr ‘25)

Playbook Creation Reimagined: The Intuitive Approach to Security Automation

Creating an Automated Workflow for Account Lockout Resolution

Automating Response to Unauthorized Scheduled Task Executions

Automating Response to Unauthorized Tor Logins

Automating Response to Suspicious Process Executions

Automated Rapid Response to Suspicious Remote Scheduled Task Creation

Announcing Unit 42 Managed XSIAM — Redefining 24/7 Managed SecOps

Automating Response to Suspicious SaaS Access From a Tor Exit Node

Automating Response to Credential Dumping Attacks

Automating Response to Unauthorized User Account Creation

SSO Password Spray Playbook

Automating Response to Unauthorized User Privilege Escalations Using PowerS...

Automating Response to Multi-Factor Authentication Threats

Automating Response to Unauthorized Email Forwarding Activity in Google Wor...

Automate Response to Event Log Clearing Alerts with Cortex XSIAM

Handling Successful SSO Sign-ins from Tor

An Automated Response to Malicious Pod Activity

Rapid Response for Fighting Ursa Phishing Campaign

Playbook of the Week: Automating Response to Living-Off-the-Land (LOTL) Att...

Get the latest news, invites to events, and threat alerts

Get the latest news, invites to events, and threat alerts

Products and Services

Company

Popular Links

Security Operations

Playbook of the Week

Rapid Response to CVE-2025-31324: Mitigating SAP NetWeaver Visual Composer Exploitation

Security Operations

Subscribe to Security Operations Blogs!

Get the latest news, invites to events, and threat alerts

Get the latest news, invites to events, and threat alerts

Products and Services

Company

Popular Links