A customer is looking for an analytics tool that uses the logs on the firewall to detect actionable events on the network. They require something to…

The Automated Correlation Engine is a feature within the Panorama management platform designed specifically for the customer's requirements. It automatically ingests and analyzes logs from all managed firewalls to identify suspicious event sequences. By using predefined correlation objects, it stitches together seemingly disparate events—such as a user visiting a suspicious URL, a subsequent malware download, and then C2 traffic—to pinpoint a compromised host. This provides an actionable, high-level conclusion, allowing security teams to quickly assess risk and respond without manually sifting through massive volumes of log data.

B. Cortex XDR and Cortex Data Lake: These are separate, more comprehensive security products, not a native feature of PAN-OS/Panorama focused solely on firewall log correlation.
C. WildFire with API calls for automation: WildFire is a malware analysis service; it does not perform broad log correlation to identify compromised host behavior patterns.
D. 3rd Party SIEM which can ingest NGFW logs: This is an external solution. The question specifically asks for a feature of PAN-OS or its associated management platform.

Palo Alto Networks. (2023). Panorama™ Administrator's Guide 10.2. "Use the Automated Correlation Engine." The guide states, "The automated correlation engine... correlates a series of related threat events that, when combined, indicate a likely compromised host on your network."

Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "Monitor Logs." This section describes the various log types that serve as the data source for the Automated Correlation Engine.