What's new
Nine Days to Exploitation. Two Weeks to Bypass. How Dataminr and Cortex Break the ToolShell Cycle.
Microsoft patched the SharePoint ToolShell vulnerability chain in July 2025. Within nine days it was under active exploitation. Within two weeks, the patches had been bypassed. Eight months later, a third variant was confirmed in the wild. Dataminr flagged the threat before the first CVE was published, giving customers weeks of early visibility that most organizations never had. This post walks through how the attack works, what it means for each team in your organization, and how Dataminr's early warning, combined with Cortex XSOAR, gives the SOC the visibility and prioritization it needs to stay ahead of a threat that won't stay fixed.
The Journey of Cortex XSOAR Playbook: Designing Your First Playbook
Transform your manual firewall upgrade process into a streamlined, automated workflow with Cortex XSOAR. This article guides you through designing a robust playbook for upgrading High Availability firewall pairs, emphasizing architectural decisions, governance integration and validation patterns. Discover how automation reduces errors, enhances efficiency and satisfies compliance requirements.
Automating Third-Party Risk with Dataminr + Cortex XSOAR
The gap between collecting threat feeds and applying real-world threat intelligence to your environment is where most programs fail. Security teams know something happened, but struggle to detect it early, determine relevance, and trigger consistent response actions. Integrating Dataminr's AI-powered real-time threat intelligence with Cortex XSOAR enables your SOC to be ahead of physical and cyber threats correlated to your environment.
When Identity Becomes the Battlefield: Why Palo Alto Networks + CyberArk Changes the Map
Palo Alto Networks' acquisition of CyberArk marks a structural shift in cybersecurity, making Identity Security a core platform pillar alongside Network and SecOps. By unifying privilege, machine and AI identity protection, the move accelerates platformization and operational resilience.
The Journey of a Cortex XSOAR Playbook: Theory and Concepts
Master Cortex XSOAR by shifting your perspective on automation. Dive into the foundational concepts of Incidents, Indicators and Playbooks to design scalable, resilient workflows. Embrace integrations, sub-playbooks and error handling to enhance efficiency. Prepare to transform raw data into actionable insights, setting the stage for advanced automation.
How Palo Alto Networks is Revolutionizing Security Operations with XSIAM
Cortex XSIAM revolutionizes cybersecurity by integrating AI, automation, and comprehensive visibility into a unified platform. Experience an autonomous SOC that empowers teams to focus on strategic threat hunting and proactive protection.
The Grizzled CyberVet's Tactical Plan: Mapping Palo Alto Networks to MITRE ATT&CK
Next up in the Grizzled CyberVet series: A global enterprise faces a full-scale cyberattack spanning every stage of the MITRE ATT&CK framework. Armed with Palo Alto Networks' full security platform, they stop the threat at every turn. Learn how a unified security strategy can outmatch attackers before they succeed. Read on to see it in action!
The Grizzled CyberVet: How Palo Alto Networks Powers End-to-End Cyber Defense
Fragmented security solutions create inefficiencies and vulnerabilities. This article explores how Palo Alto Networks' integrated platform addresses these gaps, breaking the cybersecurity kill chain at every stage. By consolidating security functions, organizations enhance threat prevention, streamline operations and reduce costs. Learn how a unified approach strengthens defenses and why proactive security is essential for business resilience.
Operationalizing Threat Intelligence with Cortex: A Maturity Model for SOCs
Transforming raw data into actionable intelligence is crucial for cybersecurity. This article explores the stages of operationalizing threat intelligence, from basic ingestion to fully automated, proactive security operations, using Cortex TIM. Learn how to enhance your SOC's capabilities, reduce manual effort and shift from reactive to proactive defense.
The Evolution of Cortex: Building the Future of Security Operations
Built on a decade of innovation and strategic acquisitions, Cortex unifies data from endpoints, networks, and cloud environments, empowering organizations to efficiently combat advanced cyber threats with minimal manual intervention.
Palo Alto Ignite Conference Key Takeaways
A brief recap of my experience at Palo Alto's Ignite conference this year. Palo Alto demonstrated Cortex XSOAR, XDR, Xpanse and the new XSIAM.