Cortex XDR — Endpoint Detection and Response

Overview

Palo Alto Cortex XDR is the primary EDR platform for Cirius Group. It is deployed on all Windows VMs and managed devices across PROD and DDE environments.

Log data is ingested via API polling (cortex_agent.py in the security monitoring pipeline). CEF syslog forwarding to the syslog VM was evaluated and dropped due to volume and cost — the API provides sufficient telemetry for detection purposes.

Coverage

Protected (Cortex XDR agent installed)

All Windows VMs — Azure PROD tenant
All Windows VMs — Azure DDE tenant
All managed user devices (laptops, workstations)

Exempt — Not covered by Cortex XDR agent

The following infrastructure components do not run the Cortex XDR agent. This is by design, not a gap.

Device class	Reason for exemption	Compensating control
Arctic Wolf VLCs (Virtual Log Collectors)	Appliance-class VMs managed entirely by Arctic Wolf; no third-party agents permitted per Arctic Wolf SLA	Arctic Wolf NDR provides behavioral monitoring; logs forwarded to SIEM
Palo Alto firewalls (all 4 — 3 Azure, 1 AWS)	PAN-OS does not support third-party endpoint agents	Panorama-managed, firewall logs forwarded via syslog VMs to Arctic Wolf VLC and LAW archive; Cortex XDR visibility layer covers network traffic via App-ID

MDE (Microsoft Defender for Endpoint) — Passive Mode

MDE Sense is present on managed devices but must remain in Passive Mode when Cortex XDR is active. Running MDE in Active Mode alongside Cortex XDR causes CPU saturation. Cortex XDR is the active EDR; MDE is passive/telemetry-only.

Log Ingestion Architecture

Cortex XDR API
      │
      ▼
cortex_agent.py  (polling, every 4-hour orchestrator run)
      │
      ▼
SecOps platform  →  incident creation / analyst triage

CEF syslog to CommonSecurityLog in LAW was evaluated and not implemented — data volume from all endpoints made this cost-prohibitive. API polling provides equivalent detection coverage.

Change History

Date	Change	Author
April 2026	Initial document — coverage map, exemptions (VLCs + PA firewalls), MDE passive mode note	Kobe

Cortex XDR — Endpoint Detection and Response ​

Overview ​

Coverage ​

Protected (Cortex XDR agent installed) ​

Exempt — Not covered by Cortex XDR agent ​

MDE (Microsoft Defender for Endpoint) — Passive Mode ​

Log Ingestion Architecture ​

Change History ​