The Fortgale European SOC 24·7·365 on the Cortex XDR console. Causality chain for automatic kill-chain reconstruction, <30 min median containment, native Palo Alto response.
Cortex XDR is the Palo Alto Networks XDR with native NGFW telemetry integration. Particularly effective for customers already on the Palo Alto stack. Fortgale operates it with European analysts who tune detection on European TTPs.
Endpoint, network, cloud on single platform. Native ingestion from PAN-OS NGFW, Prisma Access SASE, Prisma Cloud CWP. Causality chain for automatic kill-chain reconstruction. Fortgale delivers detection and response on the platform modules Cortex XDR · Cortex XSIAM · Cortex XSOAR · Cortex Xpanse.
L2/L3 analysts specialised on Cortex XDR. Triage <15 min on Cortex alerts. Custom XQL detection rules tuned on European TTPs. 34,000+ IoCs per week applied as IoC rules.
Containment via Cortex XDR Response: Live Terminal, endpoint isolation, process kill, file quarantine. Direct escalation to Fortgale IR. Full NIS2 national CSIRT notification support.
From PAN-OS + Cortex telemetry to Live Terminal response, all governed by Fortgale with European analysts and proprietary CTI on European markets.
Cortex XDR agent on endpoints, native ingestion from PAN-OS NGFW, Prisma Access, Prisma Cloud, third-party sources. Telemetry normalised in Cortex Data Lake.
Causality chain reconstructs kill-chains automatically. Fortgale develops custom XQL rules tuned on European actor TTPs. False positives reduced by over 90%.
European SOC specialised on Cortex XDR. Triage on causality, hunting via XQL, attribution to actor. Decisions in your business language.
Containment via Cortex Response: Live Terminal for forensic investigation, endpoint isolation, process kill, file quarantine. Direct escalation to Fortgale IR for critical incidents.
Metrics measured on real customer telemetry, Q1 2026, updated quarterly.
The platform produces telemetry. What is missing is the people who read it around the clock, prioritise it and turn it into decisions.
Tier-zero AI filters, analysts decide: noise reduced >90% by day 30. Every alert that reaches you is already a qualified case.
L2/L3 analysts who operate the Cortex console every day: detection tuning, MITRE-mapped runbooks, native response on your platform.
European SOC, headquartered in Milan since 2017, 24·7·365: median TTD <15 minutes, median TTC <30 minutes.
Multi-stage intrusions detected, contained and publicly documented by the research team: Operation Storming Tide, Operation MN-1224.
Proprietary CTI on 287 tracked adversary groups and attack tools: advisories, IOCs and actor profiles feed directly into detection on your platform.
Selection of network + endpoint threats observed on Fortgale customers with Cortex. Cortex's automatic stitching unifies NGFW, endpoint and cloud events into the same incident.
Vector Initial access via VPN edge appliance · Rust-based ransomware payload · cross-platform (Windows + Linux + ESXi) · triple extortion
Detection · Cortex Cortex XDR Identity Threat Detection + NGFW intra-zone segmentation + anti-encryption ML model on file-system anomaly.
Vector Post-exploit framework · HTTPS beacon with TLS-pinning · anti-EDR sleep mask · Malleable C2 profile
Detection · Cortex Cortex Analytics Engine on Network anomalies + AutoFocus IOC + WildFire sandbox for pre-delivery payload detonation.
Vector Initial Access Broker · sells VPN/RDP access to ransomware gangs · OAuth phishing + brute-force on Palo Alto/Fortinet/Citrix edge appliances
Detection · Cortex Cortex Identity Threat Detection + NGFW threat-prevention signatures + Fortgale IOC feed auto-pushed into PAN-OS.
Vector USB-borne LNK file · command-line abuse · secondary drops (SocGholish, Bumblebee, Truebot) · ransomware pivot
Detection · Cortex Cortex XDR Behavioral Threat Protection + WildFire sandbox + anomalous DNS query correlation via DNS Security.
Every component designed to leverage Cortex XDR + Palo Alto stack with European SOC governance and proprietary CTI.
Cortex XDR licensing (or existing instance). Endpoint agent, NGFW data ingestion, Prisma integrations managed by Fortgale. Continuous tuning per environment.
Custom XQL rules MITRE ATT&CK-mapped, tuned on European actor TTPs. Causality chain enrichment. New rules deployed monthly.
34,000+ IoCs per week from Fortgale OpenCTI imported as Cortex XDR IoC rules. Native enrichment of causality chain alerts.
Containment via Cortex Response: Live Terminal forensics, endpoint isolation, process kill, file quarantine, AD lockout. Cross-tool playbooks via Cortex XSOAR.
Executive reports with MTTD, MTTR, alert volume, causality trend. Custom Cortex XDR dashboards. NIS2/ISO 27001/GDPR audit documentation.
Cortex XSOAR available as add-on for advanced playbook orchestration: cross-tool response, automatic enrichment, ticketing. Custom playbooks developed by Fortgale.
The CISO decides on risk. The IT lead decides on the runbook. Fortgale MDR produces evidence for both.
Each month the CISO receives the profile of the 3 most likely actors against their sector, with the Fortgale MDR runbook already mapped to the Cortex XDR · Palo Alto Networks telemetry.
When the Cortex alert is real, decision time is containment time. Our L2/L3 analysts know the Cortex XDR · Palo Alto Networks console and have a mandate to decide.
Combines Cortex XDR from Palo Alto Networks (endpoint, network, cloud) with the Fortgale European SOC 24·7·365. L2/L3 analysts monitor the Cortex console, leverage causality chain for triage and trigger native response (Live Terminal, isolation, process kill).
Yes. Cortex XDR natively ingests telemetry from Palo Alto Networks NGFW (PAN-OS), Prisma Access (SASE), Prisma Cloud (CWP), in addition to third-party sources. Particularly effective for customers already on Palo Alto.
No. Fortgale handles the full cycle: licensing, Cortex XDR agent deployment, data ingestion configuration (NGFW, third-party), rules tuning. Available both on existing instance or as part of the service.
Yes. We support NIS2 transposition requirements: continuous monitoring, IoC collection for national CSIRT notification within 24 hours, technical documentation for 72-hour notifications.
Cortex XDR automatically reconstructs the causality chain (cause-effect chain) of every alert by linking processes, files, network, registry. Drastically reduces triage time by letting analysts see the entire attack context in a single graph.
We bring you the Report on your sector with the most likely actors and a concrete MDR runbook on your Cortex XDR · Palo Alto Networks console.
No nurturing sequences, no auto-replies. One of our analysts calls you back within one business day.
The full Report (executive summary · operational IoCs · technical runbook) is restricted. Share two details and one of our analysts contacts you with access and a short technical briefing.
Response in 30 minutes, containment in 1–4 hours. Even if you are not a Fortgale customer.
