Which Cortex XDR feature enables automated responses to certain threats?

Cortex XDR integrates with Cortex XSOAR (Security Orchestration, Automation, and Response) to enable automated responses. When an incident is generated in Cortex XDR, it can trigger a playbook in XSOAR. These playbooks are customizable workflows that can execute a series of automated actions, such as enriching data from threat intelligence feeds, quarantining files, isolating endpoints, or creating service desk tickets, without manual intervention from an analyst. This automates and standardizes the incident response process.

B. Alert starring is a manual feature for an analyst to flag or mark alerts for follow-up; it does not trigger any automated action.
C. Manual incident reassignment is an administrative task for assigning incidents to different analysts; it is explicitly a manual process.
D. Exclusion rules are a preventative measure to suppress the creation of alerts from known benign activity, not a response to a detected threat.

1. Palo Alto Networks, "Cortex XDR Administrator's Guide," Chapter: "Incidents," Section: "Cortex XSOAR Integration." This section details how to forward incidents to XSOAR to "run playbooks to automate incident response actions."

2. Palo Alto Networks, "Cortex XSOAR Administrator's Guide," Chapter: "Incidents," Section: "Cortex XDR Incidents." This document explains how XSOAR ingests XDR incidents to trigger automated playbooks for investigation and response.