[Data Ingestion and Integration] What is a benefit of ingesting and forwarding Palo Alto Networks NGFW logs to Cortex XDR?

The primary benefit of forwarding Palo Alto Networks NGFW logs to Cortex XDR is to enrich endpoint data with critical network context. Cortex XDR correlates endpoint activity with network logs (Traffic, Threat, URL Filtering, etc.) to provide a unified view of an incident. Enabling "Enhanced Application Logging" on the NGFW provides highly granular data about network traffic, which, when ingested by Cortex XDR, allows its analytics engine to perform more sophisticated analysis, improve detection of stealthy threats, and accelerate investigations by stitching together the full attack chain across both endpoint and network domains.

A. The data flow is from the NGFW to Cortex XDR for centralized correlation and analysis, not the other way around.
B. Blocking network traffic is an enforcement action that can be orchestrated by Cortex XDR, but the core benefit of log ingestion is the enhanced analysis that enables such actions.
D. Cortex XDR and the NGFW both receive malware signatures and threat intelligence directly from the Palo Alto Networks WildFire cloud, not from each other.

1. Palo Alto Networks, Cortex XDR Administrator’s Guide, "Set Up Log Collection from Palo Alto Networks NGFW". This section states, "To provide Cortex XDR with network context for your incidents, you can forward logs from your Palo Alto Networks firewalls."

2. Palo Alto Networks, Cortex XDR Administrator’s Guide, "Enhanced Application Logs". This section explains that these logs provide "rich data about network activity" that is "used by Analytics."