Definition
Cortex XDR is an extended detection and response platform that unifies endpoint, network, and cloud data to provide advanced threat detection, investigation, and response capabilities. It leverages artificial intelligence and machine learning to analyze vast amounts of security telemetry, identifying sophisticated attacks that traditional security tools might miss. By correlating events across multiple security layers, Cortex XDR offers a holistic view of threats, enabling security teams to respond more effectively and efficiently. For instance, it can detect a phishing email that leads to malware execution on an endpoint, then trace the malware's network activity to identify compromised systems. Unlike standalone endpoint detection and response (EDR) solutions, Cortex XDR integrates network and cloud security data for broader visibility. This technology is relevant for cybersecurity certifications such as CompTIA CySA+ and may appear in advanced security domains.