Competitive Intelligence: Q1 2020 Update

Expires Apr. 1st, 2020. This version replaces all previous versions.

Recent News Focus to Win . . . Gartner Caveats: Palo Alto

February 2020 - Cortex XDR
Managed Threat Hunting Service
announced. Managed Threat
Hunting fully back by Unit 42.
Customers will see improved
analytics and more robust
“proactive” response/actions.
February 2020 - Updates to
Cortex XDR -
XDR updates include improved
visibility /reporting and expanded
API integrations (including
Demisto).
January 2020 - PAN Prisma Cloud
achieves ‘In Process’ FedRAMP
designation
PAN Cortex Details / History
Cortex is a move against the domination
of Splunk in regards to big data analysis
done in the cloud. This fits into PANW
plan to be the platform of security, with
their recent SOAR acquisition of Demisto.
Cortex 2.0 was announced in November
2019. Cortex 2.0 centers around
providing updated/new "toolsets" to
improve visibility, usability, and endpoint
protect features. 3rd party data injestion
is broadened as well. Prior to this launch,
management of Traps and Cortex XDR
was achieved via separate consoles. This
has been unified in the Cortex 2.0 release
Detection: There is still heavy cloud-
reliance across the Cortex suite of
technology. Endpoint protections are
still reliant (first) on Wildfire and
cloud/reputation lookups. To date,
behavioral detection is touted as a
“Behavioral AI” approach, but they are
still primarily based on set rules and
known-behaviors dictated by
“BIOCs” (Behavioral Indicators of
Compromise). Endpoint protection
for kernel-based exploits is still non-
existent.
Protection: Full context of attacks is
not uniformly identified or alerted to.
There is a heavy reliance on granular
child-process detection. Often they
may identify a component of an
attack as a ‘child process’ without
identifying the malicious parent
process responsible.
Response: Cortex has not native and
automated remediation or response.
All necessary tasks are manual, or
need to be “defined” manually via 3rd
party integration.
Forensics / EDR: There is limited
contextual visibility for events tied to
a singular malware campaign. Putting
all the “events” together for a single
“attack”. Cotex relies heavily on
Wildfire analysis and Windows event
logs to piece together their version of
a “storyline”
Palo Alto has grown its presence in
the EPP and EDR market primarily
through acquisition of component
parts it has integrated together.
Traps is missing common enterprise
EPP features, such as rogue device
discovery, application control, USB
device controls, resource utilization
tuning, and extensive role-based
administration. Palo Alto’s EDR
capability has limited workflow and
no ability to create custom block
rules.
Palo Alto currently doesn’t offer
MDR/ Managed EDR
(MEDR)services as part of its native
offering and uses partner
ecosystem for delivering these
services.
Palo Alto does not have
vulnerability or configuration
management information.
While Traps is being licensed on an
agent basis, Cortex XDR is sold
based on storage size and period, in
contrast to an agent basis, and it
can only be purchased in discrete
numbers of 1TB storage. Each TB
license comes with 200 agent
licenses included.

Sen$nelOne’s Differen$ators
#1 On device AI, for static and behavioral detection in a single agent.

#2 Simple and clean management interface improves visibility

and reduces responder workload

#3 Feature parity across support platforms (Win, macOS, Linux)

In Process
#4 Remediate / Repair / Rollback

#5 Complete API (bi-directional, full product/policy control)

#6 Cloud-agnostic prevention of LOTL and “Fileless” attack TTPs

#7 Alerts mapped to the MITRE ATT&CK framework

605 Fairchild Drive, Mountain View,CA 94043 | +1-855-868-3733 | partners.sentinelone.com | channel@sentinelone.com | S1 Partner & Internal Use Only
Securing the
Best of the Best.
At SentinelOne, customers are #1. Global industry
leaders across every vertical thoroughly test and
select us as their endpoint security solution of
today and tomorrow. We protect trillions of
dollars of enterprise value across millions of
endpoints. The SentinelOne platform safeguards
the world’s creativity, communications, and
commerce on devices and in the cloud.

605 Fairchild Drive, Mountain View,CA 94043 | +1-855-868-3733 | partners.sentinelone.com | channel@sentinelone.com | S1 Partner & Internal Use Only