01 ·
Cortex XDR · Palo Alto-native
Endpoint, network, cloud on single platform. Native ingestion from PAN-OS NGFW, Prisma Access SASE, Prisma Cloud CWP. Causality chain for automatic kill-chain reconstruction.
MDR sur Cortex XDR: Palo Alto-native detection, governed by senior analysts.
The Fortgale SOC européen 24·7·365 on the Cortex XDR console. Causality chain for automatic kill-chain reconstruction, ~11 min median containment, native Palo Alto response.
Fortgale × Cortex
MDR · live
Sensore Cortex attivoTelemetria endpoint · cloud · identità
Cortex SOC italiano 24·7·365Analisti L2/L3 · interlocuzione diretta
Fortgale Tier-zero AI multidominioRumore ridotto del 94%
Fortgale Risposta nativa CortexIsolamento host mediano ~8 s
Live Intelligence proprietaria34 000+ IOC settimanali · attori italiani
Fortgale MDR operativo — Cortex + Fortgale SOC attivi
Conformità
ISO/IEC 27001
NIS2 ready
DORA aligned
GDPR · ACN
Partnership tecnologica
Cortex XDR · Palo Alto Networks
MITRE ATT&CK aligned
OpenCTI
Pourquoi Fortgale + Palo Alto Cortex
Cortex XDR + Palo Alto firewalls, operated with proprietary CTI.
Cortex XDR is the Palo Alto Networks XDR with native NGFW telemetry integration. Particularly effective for customers already on the Palo Alto stack. Fortgale l'opère avec analystes européens who tune detection on European TTPs.
02 ·
SOC européen 24·7·365
L2/L3 analysts spécialisés sur Cortex XDR. Triage <15 min on Cortex alerts. Custom XQL detection rules tuned on European TTPs. 34,000+ IoCs per week applied as IoC rules.
03 ·
Native response + IR
Containment via Cortex XDR Response: Live Terminal, endpoint isolation, process kill, file quarantine. Escalade directe to Fortgale IR. Accompagnement complet à la notification CSIRT national NIS2 notification.
Comment ça marche · architecture
Quatre blocs, un cycle MDR on Cortex XDR.
From PAN-OS + Cortex telemetry to Live Terminal response — le tout gouverné par Fortgale with analystes européens and proprietary CTI sur les marchés européens.
01 ·
01 · Ingestion
Cortex agent + PAN-OS active
Cortex XDR agent on endpoints, native ingestion from PAN-OS NGFW, Prisma Access, Prisma Cloud, third-party sources. Telemetry normalised in Cortex Data Lake.
02 ·
02 · Tier-zero
Causality chain + custom XQL
Causality chain reconstructs kill-chains automatically. Fortgale develops custom XQL rules tuned on European actor TTPs. Faux positifs réduits by 94%.
03 ·
03 · Analysts
Our L2/L3 on Cortex
European SOC spécialisés sur Cortex XDR. Triage on causality, hunting via XQL, attribution to actor. Decisions dans votre langue business.
04 ·
04 · Response
Cortex Live Terminal + IR
Containment via Cortex Response: Live Terminal for forensic investigation, endpoint isolation, process kill, file quarantine. Escalade directe to Fortgale IR for incidents critiques.
Proof · metriche del servizio
Quattro numeri che reggono l'MDR su Cortex.
Metriche misurate sulla telemetria reale dei nostri clienti — Q1 2026, aggiornate trimestralmente.
~11 min
Confinement médian
from confirmed Cortex alert
from confirmed Cortex alert
94 %
Bruit réduit
par causality chain + AI
par causality chain + AI
Native
PAN-OS + Cortex
intégrée telemetry
intégrée telemetry
10 days
Onboarding complet
Cortex XDR + PAN-OS
Cortex XDR + PAN-OS
Ce que comprend le service
MDR sur Cortex XDR, en détail.
Every component designed to leverage Cortex XDR + Palo Alto stack with European SOC governance and proprietary CTI.
01
Managed Cortex XDR
Cortex XDR licensing (or existing instance). Endpoint agent, NGFW data ingestion, Prisma integrations managed by Fortgale. Continuous tuning per environment.
02
Custom XQL detection
Custom XQL rules MITRE ATT&CK-mapped, tuned on European actor TTPs. Causality chain enrichment. New rules deployed monthly.
03
Proprietary CTI in Cortex
34,000+ IoCs per week from Fortgale OpenCTI imported as Cortex XDR IoC rules. Native enrichment of causality chain alerts.
04
Native Cortex response
Containment via Cortex Response: Live Terminal forensics, endpoint isolation, process kill, file quarantine, AD lockout. Cross-tool playbooks via Cortex XSOAR.
05
Reporting & governance
Executive reports with MTTD, MTTR, alert volume, causality trend. Custom Cortex XDR dashboards. NIS2/ISO 27001/GDPR audit documentation.
06
Cortex XSOAR (optional)
Cortex XSOAR available as add-on for advanced playbook orchestration: cross-tool response, automatic enrichment, ticketing. Custom playbooks developed by Fortgale.
Per chi · due angolazioni
Stesso MDR su Cortex, due angolazioni.
Il CISO decide sul rischio. Il responsabile IT decide sul runbook. MDR Fortgale produce evidenze per entrambi.
Per il CISO
Un runbook nominativo per attore, su stack Cortex.
Il CISO riceve ogni mese il profilo dei 3 attori più probabili contro il proprio settore, con il runbook MDR Fortgale già mappato sulla telemetria Cortex XDR · Palo Alto Networks.
- Threat briefing mensileAttori, TTP osservate, campagne in corso sul vostro settore.
- Runbook su CortexPlaybook vivi mappati MITRE, eseguibili sulla console Cortex XDR · Palo Alto Networks.
- Reporting board-readyRischio · impatto · decisione. Niente tecnologia da slide.
Per il responsabile IT
Zero handover traduttore. Analisti italiani sulla vostra console Cortex.
Quando l'alert Cortex è reale, il tempo di decisione è il tempo di contenimento. I nostri analisti L2/L3 conoscono la console Cortex XDR · Palo Alto Networks e hanno mandato di decidere.
- Contenimento mediano ~11 minDall'alert confermato alla remediation in produzione.
- Risposta nativa CortexKill processi, isolamento host, network containment via API Cortex XDR · Palo Alto Networks.
- Integrazione end-to-endTelemetria Cortex ingerita nella nostra data fabric multidominio.
FAQ · frequently asked
Everything to know before talking to our analysts.
What is the Fortgale MDR service on Cortex XDR?
Combines Cortex XDR from Palo Alto Networks (endpoint, network, cloud) with the Fortgale SOC européen 24·7·365. L2/L3 analysts monitor the Cortex console, leverage causality chain for triage and trigger native response (Live Terminal, isolation, process kill).
Is Cortex XDR compatible with existing PAN firewalls?
Yes. Cortex XDR natively ingests telemetry from Palo Alto Networks NGFW (PAN-OS), Prisma Access (SASE), Prisma Cloud (CWP), in addition to third-party sources. Particularly effective for customers already on Palo Alto.
Do I need to already have Cortex XDR?
No. Fortgale handles the full cycle: licensing, Cortex XDR agent deployment, data ingestion configuration (NGFW, third-party), rules tuning. Available both on existing instance or as part of the service.
Is the service NIS2-compliant?
Yes. We support NIS2 transposition requirements: monitoring continu, IoC collection for national CSIRT notification sous 24 heures, technical documentation for 72-hour notifications.
What does the Cortex XDR causality chain do?
Cortex XDR automatically reconstructs the causality chain (cause-effect chain) of every alert by linking processes, files, network, registry. Drastically reduces triage time by letting analysts see the entire attack context in a single graph.
Parla con il presidio
Un incontro. Un NDA. Un runbook reale su Cortex.
Ti portiamo il Report sul tuo settore con gli attori più probabili e un runbook MDR concreto sulla tua console Cortex XDR · Palo Alto Networks.