Which endpoint tool or agent can enact behavior-based protection?

Cortex XDR is an extended detection and response platform that includes an agent installed directly on endpoints (workstations, servers). A core function of this agent is Behavioral Threat Protection (BTP). BTP continuously monitors chains of events, such as process activity, inter-process communication, and network connections, to identify and block malicious behaviors characteristic of attacks like ransomware, credential theft, and fileless malware. It analyzes the sequence and context of actions rather than relying solely on static file signatures, which is the essence of behavior-based protection.

A. AutoFocus: AutoFocus is a cloud-based threat intelligence service that provides context for threats; it is not an endpoint agent and does not directly enact protection.
C. DNS Security: This is a cloud-delivered network security service that blocks access to malicious domains by inspecting DNS queries. It does not monitor on-device process behavior.
D. MineMeld: MineMeld is an open-source threat intelligence processing application used to aggregate and share indicators of compromise. It is not an endpoint protection tool.

1. Palo Alto Networks, "Cortex XDR Datasheet": "The Cortex XDR agent blocks threats with a stack of prevention modules. ... Behavioral Threat Protection: The Cortex XDR agent detects and stops attack activity by continuously monitoring endpoint behavior and identifying anomalous event chains." (Page 2, "Unrivaled Endpoint Protection" section).

2. Palo Alto Networks, "Cortex XDR Administrator’s Guide": The guide details the configuration of security profiles, including a specific profile for "Behavioral Threat Protection." It states, "Behavioral threat protection (BTP) constantly monitors endpoint activity for anomalous behavior." (Chapter: "Create a New Agent Settings Profile", Section: "Behavioral Threat Protection").

3. Palo Alto Networks Education Services, "EDU-260: Cortex XDR: Prevention and Deployment" Course Description: The course outline explicitly lists "Behavioral Threat Protection" as a key module, covering how the agent "monitors for malicious event chains" and how to "manage BTP rules." (Module 6: "Behavioral Threat Protection").