A Cortex XSIAM analyst in a SOC is reviewing an incident involving a workstation showing signs of a potential breach. The incident includes an alert…

The most effective initial response action to reduce attacker mobility is to isolate the endpoint. The alert "Remote service command execution from an uncommon source" indicates an attacker may be using the compromised workstation to move laterally within the network. The "Isolate Endpoint" action severs all network connections to and from the device, except for communication with the Cortex XDR management console. This immediately contains the threat by preventing the attacker from accessing other network resources, effectively stopping any further lateral movement or data exfiltration while allowing the analyst to continue their investigation.

B. Remove Malicious File: This action is for remediation but does not stop a process already running in memory or address other persistence mechanisms the attacker may have established.
C. Terminate Process: While useful, this only stops a specific known malicious process. The attacker could have multiple backdoors or a way to restart the process, making it an incomplete containment measure.
D. Block IP Address: This only prevents communication with a specific external IP address. It does not prevent the attacker from moving laterally to other systems within the internal network.

1. Palo Alto Networks, Cortex XDR Administrator’s Guide: In the section "Take Action from an Incident," the "Isolate Endpoint" action is described. It states, "To stop a threat from spreading, you can isolate an endpoint or multiple endpoints from your network... When you isolate an endpoint, Cortex XDR stops all network access on the endpoint except for traffic to the Cortex XDR console." This directly supports its use for preventing threat propagation (attacker mobility). (Reference: Cortex XDR Administrator's Guide, Chapter: Incident Management, Section: Take Action from an Incident).

2. Palo Alto Networks, Cortex XDR Agent Administrator's Guide: The guide details the functionality of endpoint isolation. "When you isolate an endpoint, the Cortex XDR agent blocks all networking on the endpoint, for all processes, except for traffic between the agent and its server components." This confirms its role as a primary network containment tool. (Reference: Cortex XDR Agent Administrator's Guide, Chapter: Response Actions, Section: Isolate Endpoint).