Palo Alto Networks

playbook of the week

Playbook of the Week: Automating Response to Living-Off-the-Land (LOTL) Attacks

Organizations face increasingly sophisticated cyberattacks in today's rapidly evolving threat landscape. Attackers leverage common tools and living-Off-the-Land binaries (LOLBins) to blend in with typical network traffic. Defenders struggle to differentiate between benign and malicious actions in logs.

Playbook of the Week

Uncategorized

May 09, 2024

By Erez Felman Dar

Palo Alto Networks

Products and Services

Partners

Playbook of the Week

Playbook of the Week: Prisma Cloud Compute - Compliance Alert v2

Maintaining compliance with regulations and security standards is paramount for organizations in today's dynamic and ever-evolving cybersecurity landscape. However, simply receivin...

Apr 11, 2024

By Tomer Haimof

Playbook of the Week

Playbook of the Week: Streamlining Suspicious Data Upload Alert Investigati...

Data exfiltration refers to the unauthorized transfer of sensitive or confidential information from a network or system to an external location. This covert activity often occurs s...

Apr 05, 2024

By Tal Nossen

Playbook of the Week, Uncategorized

Playbook of the Week: Automating Management of XDR Identity Analytics Alert...

Identity analytics is a critical cybersecurity tool in combating the challenges posed by compromised user accounts and malicious insiders. Identity th...

Mar 07, 2024

By Omri Itzhak

Playbook of the Week, Uncategorized

Playbook of the Week: Using YARA to Automate Malware Identification and Cla...

In the dynamic realm of cybersecurity, maintaining a proactive defense against evolving threats is non-negotiable. One potent weapon that has emerged...

Feb 01, 2024

By Yarden Altmann

Playbook of the Week

Playbook of the Week: Prisma Cloud Compute - Audit Alert v3

As applications are deployed across multiple clouds - public, private, hybrid - organizations are using a wide array of compute architectures. You have virtual machines (VMs), cont...

Jan 25, 2024

By Tomer Haimof

Playbook of the Week

Playbook of the Week: XSOAR Common Playbooks

As you embark on automating your security operations, determining which use cases to prioritize for automation can be a challenge. It requires careful consideration of your organization's unique threat landscap...

Jan 11, 2024

By Tal Nossen

Playbook of the Week

Introducing New XSOAR Capture the Flags!

Well, we have infused the fun element of the game into our capture the flag (CTF) content packs which take you on an interactive “treasure hunt” in Cortex XSOAR.

Dec 14, 2023

By Sasha Sokolovich

Playbook of the Week, Uncategorized

Bootstrap Your Threat Intel Management Program With Free Feeds and IOC Enri...

Getting your threat intel management (TIM) program up and running might seem like a daunting task. Picking the right feeds and enrichers can be challe...

Dec 07, 2023

By Dror Avrahami

Announcement, Playbook of the Week

Playbook of the Week: Streamlining the management of XDR Incidents

The new Cortex XDR Lite - Incident Handling playbook is a new addition to the Palo Alto Networks Cortex XDR - Investigation and Response content pack....

Nov 09, 2023

By Omri Itzhak

Playbook of the Week

Playbook of the Week: Unleash the Power of Identity Threat Intelligence wit...

When it comes to detecting identity-related threats, security teams need to distinguish between suspicious but benign activity and truly malicious activity. This can be challenging...

Oct 24, 2023

By Ido Van Dijk

Playbook of the Week

Playbook of the Week: Automating DLP Incident Feedback

In today's digital landscape, data loss prevention (DLP) solutions have become a critical component for keeping sensitive data secure in an organization. With an increasing amount of data being generated and sh...

Sep 07, 2023

By Tomer Haimof

Playbook of the Week

Playbook of the Week: Using CVEs in Incident Investigation

The Common Vulnerabilities and Exposures (CVE) repository is designed to provide a reference for a publicly known information security vulnerability. CVE identifiers, or CVEs, are...

Aug 03, 2023

By Dror Avrahami

Playbook of the Week

Playbook of the Week: Automating Malicious File Detonation with Joe Securit...

The role of a security analyst has evolved significantly over the years, as the nature of cybersecurity threats have become increasingly sophisticated and complex. Today's security...

Apr 20, 2023

By Arad Carmi

Announcement, Must-Read Articles, Playbook of the Week

Playbook of the Week: Automated Rapid Response to 3CXDesktopApp Supply Chai...

A supply chain attack involving a software-based phone application called 3CXDesktopApp hit at the end of March.

Apr 06, 2023

By Jane Goh

Playbook of the Week

Playbook of the Week: Automating the Prioritization of Prisma Cloud Virtual...

Understanding and visualizing your cloud risks can be difficult to do. And, even if you have overcome those issues, the more data you collect often means more alerts and more work...

Mar 30, 2023

By Tomer Haimof

Must-Read Articles, News and Events, Playbook of the Week

Playbook of the Week: Automated Rapid Response to Microsoft Outlook for Win...

Automate Your Response to the Microsoft Outlook for Windows Vulnerability (CVE-2023-23397) On March 14th 2023, as part of Microsoft’s Patch Tuesday re...

Mar 21, 2023

By Ben Melamed

Playbook of the Week: Catch Me if You Can! Stopping the Impossible Traveler

Employee remote work continues to challenge the security measures of organizations. Is the user who keeps trying to access your cloud applications from Boston really Amelia in HR, who logged in this morning fro...

Mar 10, 2023

By Charity Spiri

Playbook of the Week

Playbook of the Week: Manage Secrets and Protect Sensitive Data

Information security teams rely on a variety of products and tools to manage their daily work. Each product typically has its own login details, creating a significant challenge fo...

Mar 03, 2023

By Moishy Matyas

Playbook of the Week, Uncategorized

Automate Workflows Using Threat Vault

As a security analyst, staying up-to-date on the latest threats is a crucial part of your job. This can be a time-consuming task, especially if you are manually researching vulnerabilities, exploits, viruses, and spyware. That's where Threa...

Jan 20, 2023

By Bar Katzir

Playbook of the Week, Uncategorized

Playbook of the Week: Uncovering Unknown Malware Using SSDeep

Cryptographic hashes like MD5 are often used to identify malware, but as malware evolves, new iterations of the same malware are being released consta...

Jan 13, 2023

By Ido Van Dijk

Load more blogs