Category Archives: Cybersecurity

Cisco XDR incidents are correlated groups of security detections assembled from Cisco and supported third-party sources. Current Cisco XDR documentation describes a real-time correlation engine that analyzes shared observables, overlapping timelines, related attack patterns, native detections, threat intelligence, network telemetry, endpoint events, identity signals, cloud alerts, and other integrated data to determine when several findings […]

IKEv2 troubleshooting is easiest when the tunnel is treated as a sequence of dependencies: IP reachability to the peer, IKE_SA negotiation, authentication, CHILD_SA/IPsec negotiation, route/crypto-domain selection, NAT exemption, access control, and finally packet counters in both directions. Cisco Secure Firewall and ASA use IKEv2 for site-to-site and remote-access VPNs, with current management platforms exposing VPN […]

Cisco TrustSec microsegmentation uses Security Group Tags (SGTs) and Security Group ACLs (SGACLs) to express access policy between roles instead of between subnets. Cisco ISE assigns SGTs to users, devices, and workloads through authentication/authorization or static mappings, distributes environment and policy data, and maintains the TrustSec matrix that defines which source group can communicate with […]

Cisco Secure Firewall decryption policies determine how TLS/SSL traffic is decrypted, bypassed, blocked, or evaluated before access-control and deeper inspection. Current Secure Firewall Management Center and Device Manager 7.7 documentation separates actions such as Decrypt – Re-sign for outbound client traffic, Decrypt – Known Key for inbound servers where the private key is available, Do […]

Passkeys are FIDO credentials that replace shared passwords with public-key cryptography tied to a relying party. FIDO2 combines the W3C Web Authentication (WebAuthn) API used by websites/app platforms with the FIDO Client-to-Authenticator Protocol (CTAP) used between clients and external authenticators. WebAuthn Level 3 became a W3C Recommendation in August 2026, and FIDO Alliance continues to […]

A ransomware tabletop exercise is a facilitated scenario that tests decision-making, coordination, and recovery without deploying real malware or disrupting production. CISA’s Tabletop Exercise Packages include ransomware scenarios, and the current #StopRansomware Guide provides prevention and response checklists that can be turned into exercise objectives. The value is not whether participants “solve” a fictional attack […]

The Common Vulnerability Scoring System (CVSS) is an open framework for communicating vulnerability severity. CVSS v4.0 is the current FIRST standard and separates metrics into Base, Threat, Environmental, and Supplemental groups. The most important operational lesson is that a CVSS Base score is not a patch-priority score by itself: it describes intrinsic severity under generalized […]

Cortex Cloud Posture Security is Palo Alto Networks’ cloud posture layer inside Cortex Cloud, designed to discover cloud assets, evaluate misconfigurations and exposure, connect risks through asset relationships and attack paths, and turn findings into prioritized issues scoped by policy. Current Cortex Cloud consolidates Application Security, Cloud Posture Security, Runtime Security, and SOC workflows on […]

Cortex Cloud Runtime Security is Palo Alto Networks’ cloud workload protection layer for detecting and preventing threats while workloads are running. Current Cortex Cloud documentation covers virtual machines, containers, Kubernetes, serverless functions, web/API workloads, images, and related cloud assets, combining agentless visibility/scanning with runtime protection, workload policies, threat intelligence, and issue/case workflows in the same […]

Cortex XDR Behavioral Indicators of Compromise (BIOC) rules detect tactics, techniques, and behaviors rather than only static indicators such as hashes, domains, or IP addresses. Current Cortex XDR documentation allows analysts with the required XDR Pro licensing/permissions to create custom BIOCs with XQL-based filtering, test them against historical tenant data, generate issues/alerts on new matches, […]

Cortex XDR prevention profiles are reusable endpoint security configurations that define how Cortex XDR agents respond to malware, exploit attempts, behavioral restrictions, and agent settings before those profiles are attached to prevention policy rules. Current Cortex XDR exposes profile types such as Malware, Exploit, Restrictions, and Agent Settings in the Prevention area, while host firewall […]

Cortex XSIAM automation connects security issues and events to playbooks, Quick Actions, jobs, connectors, and—currently in Preview for selected tenants—Agentic Response actions. Automation rules define trigger conditions and the action to run when an issue matches. The execution model matters: current Cortex XSIAM documentation notes that automated executions triggered by rules, jobs, or feed-triggered actions […]

Cortex XSIAM data modeling normalizes logs from different vendors and products into a shared XSIAM Data Model (XDM) so analysts, correlation rules, dashboards, and detections can query consistent fields instead of memorizing every source schema. Current XSIAM provides a published XDM schema with typed fields, constants, and aliases such as IP, user, file hash, domain, […]

A Software Bill of Materials (SBOM) is a machine-readable inventory of software components and their supply-chain relationships. It helps software producers, purchasers, and operators answer which libraries, packages, versions, licenses, and dependencies are present in a product so newly disclosed vulnerabilities or licensing issues can be mapped to affected software faster. In 2025 CISA published […]

Cortex XSIAM detection engineering combines several detection mechanisms: IOC rules for known indicators, BIOCs for behavioral conditions, scheduled XQL correlation rules for relationships across events and time, and analytics rules produced by the platform’s behavioral analytics engines. Current XSIAM 3.x documentation exposes these under Threat Management and Analytics, with MITRE ATT&CK coverage views, correlation-rule monitoring, […]