What is the key difference between prevention policies and extension policies?

The core distinction lies in their function. Prevention policies are fundamental to the agent's security posture, managing the primary malware, exploit, and behavioral threat prevention capabilities. Extension policies, on the other hand, are used to manage optional, add-on modules that extend the agent's functionality beyond core threat prevention. These extensions can include features like Device Control, Host Firewall, and Disk Encryption, which are licensed and configured separately. This modular approach allows administrators to tailor endpoint capabilities to specific needs.

B. Prevention policies define dashboards, while extension policies manage incidents: Policies define endpoint behavior; they do not configure the user interface (dashboards) or incident response workflows.
C. Prevention policies apply to networks, while extension policies apply only to endpoints: Both prevention and extension policies are configured in Cortex XDR to manage the behavior of agents on endpoints.
D. Both policies perform identical tasks: They are functionally distinct, with prevention policies handling core security and extension policies managing optional add-on modules.

1. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Get Started with Host Insights, Device Control, and Host Firewall". This document explains that features like Device Control are managed through their own profiles, separate from the main Prevention profiles.

2. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Malware Protection". This section details the capabilities configured within a Prevention Profile, such as static analysis, behavioral threat protection, and exploit protection, confirming its role in core defense.