The best feature of Cortex Cloud by Palo Alto Networks is the credit view and execution view, where I can check on any vulnerability. Whether I want to check for vulnerabilities, I can easily determine which asset or onboarded endpoint is vulnerable to any vulnerability. The raw JSON format and software bill of materials are also cool features that are very helpful. Regarding MITRE ATT&CK evaluation, Cortex Cloud by Palo Alto Networks maps any attack with the MITRE ATT&CK framework very well. Just having a glimpse at the mapping, I can get an understanding about the attack, including what techniques and tactics are involved. This is a very good feature and a great initiative from Palo Alto Networks. It is very helpful in terms of investigation. Whenever I am working on any attack investigation and response, it helps me determine the severity and plan future strategies to reduce such attacks. Cortex Cloud by Palo Alto Networks has reduced approximately 40% of manual tasks because of the automated response and automation capabilities. This reduction in time happened in the starting phase itself, which is very positive. Regarding incident investigation with Cortex Cloud by Palo Alto Networks, based on my experience, I could say it reduced the time by around 60 to 70%. Things are now very clear and accessible at the distance of one click. If I want to evaluate or investigate any attack, Cortex Cloud stitches all the data together. It stitches endpoint data, network data, and identity data, giving me very clear information about the attack. I can see what is happening, from where it has initiated, what assets are involved, and what users are involved. It provides a timeline view showing the causality chain, which is a very good feature. Because of this, it reduces incident investigation time by up to 60 to 70%.
