The data layer, added to your XDR.

Helm watches what happens to your files and acts on the rules you set. When it detects ransomware, it can have Cortex XDR isolate the endpoints involved, and every step is recorded for your team.

Most of the damage in a ransomware attack lands on file servers, NAS and cloud storage, often reached over the network rather than from the device running the code. Helm sits where that data lives. It detects encryption in under a second and contains the attack on rules your team can read and check.

Cortex XDR from Palo Alto Networks brings together data from endpoints, network, cloud and identity sources, with a unified agent on each endpoint. Analysts can isolate a compromised endpoint, cutting all its network access except the link to Cortex. Cortex XDR sees across your estate. Helm adds the view from inside your data.

When Helm contains an attack, it can look up the endpoints involved in Cortex XDR, by host name or by the user logged on, and have Cortex isolate them through its API. Isolated endpoints keep their link to Cortex, so your team can investigate them safely.

Each step is recorded in the Helm incident, and endpoints are released once they are confirmed clean.

Helm contains the attack on the rules you set and keeps the evidence; Cortex XDR carries out the action across your endpoints. If you also run Palo Alto Networks firewalls, see how Helm works with them.

See all integrations, or talk to us about adding Helm to Cortex XDR.