Welcome to the Cato XOps Service

Threat Prevention - The Cato XOps Threat Prevention producer detects a specific set of attack behaviors in events generated by Cato’s real-time security services, such as IPS and Anti-Malware. The Threat Prevention stories help analysts focus on immediate, high-confidence threats.

Threat Prevention stories are usually based on correlated block events, meaning events for traffic that was blocked by one of the Security services. However, even though the traffic was already blocked, it is possible that this traffic relates to an ongoing threat. The XOps story lets you investigate the context and details of the suspicious traffic to help determine if there is still a threat that requires further mitigation.

For more about Threat Prevention stories, see Drilling-Down and Analyzing XOps Security Stories.

Threat Hunting - The Threat Hunting producer continuously scans the vast amount of historical traffic data stored in the data lake to detect traffic patterns that indicate potential threats. As opposed to the Threat Prevention producer, which focuses on recent events, the Threat Hunting producer looks for correlations over time in the stored traffic data. Correlations are identified over one week's data to ensure accuracy. Further, while the Threat Prevention producer looks at data in the event logs, the Threat Hunting producer analyzes a broader set of data from the traffic flows. This enables the Threat Hunting producer to detect more evasive threats that are difficult to identify with conventional methods because they generate a lower and harder-to-detect signature.

The following is the Overview page for a Threat Hunting story that identified 40 different traffic flows (signals) relating to a cybersquatting phishing threat:

For more about Threat Hunting stories, see Drilling-Down and Analyzing XOps Security Stories.

Usage Anomaly - Part of Cato's User and Entity Behavior Analytics (UEBA) capabilities, this producer compares user and site network activity with baselines calculated by machine learning algorithms, and generates stories for suspicious deviations from baseline usage levels. For example, a specific user is detected using more upstream bandwidth than usual.

For more about Usage Anomaly stories, see Analyzing XOps UEBA Stories for Usage and Events Anomalies.

Events Anomaly - Another element in Cato's UEBA capabilities, this producer detects indications that involve an entity on the network triggering an unusual number of Security events. For example, a user is associated with an unusually large number of IPS block events for traffic to a specific direction, which can indicate a potential infection on the user's device.

For more about Events Anomaly stories, see Analyzing XOps UEBA Stories for Usage and Events Anomalies.

Experience Anomaly: Detects unusual changes in application experience for specific sites and applications. After monitoring an application for 14 days, it creates a baseline using TTFB (Time to First Byte). The producer then checks the traffic once a day, and generates a story when the application experience is significantly different from the baseline. The story helps you review the affected site, application, traffic flows, and possible performance issues.

Account Operations: Detects account-level issues that can impact users, sites, and services. This includes issues such as directory sync failures, license exhaustion, expired certificates, connector issues, and other configuration or operational problems. The producer generates stories that help you understand the issue, review its scope and impact, and follow guided remediation steps to restore normal operation.

Predictive Insight: Detects potential performance and availability risks before they impact service. It analyzes network trends, resource usage, and configuration context to forecast developing issues. For example, it can generate a story when a site Socket is expected to exceed acceptable CPU usage. The story helps you review the forecast, understand when the issue may become critical, and follow guided remediation steps

Microsoft Endpoint Alerts - Customers who use Microsoft Defender for Endpoint can integrate the Defender alert data with Cato XOps to produce stories for endpoint devices. The Microsoft Endpoint Alerts producer creates a story by correlating data from Defender Alerts that occurred on the same device within a 24-hour period. Endpoint Alert stories include all relevant evidence for the Alert detected by Defender. By expanding the focus to the endpoint, these stories help you get a more complete picture of potential threats in your network.

For more about integrating Defender for Endpoint with Cato XOps, see Microsoft Defender for Endpoint Alerts: Configuring the XOps Integration.

Microsoft Entra ID Alerts - You can integrate alert data from Microsoft Entra ID Protection to generate Cato XOps stories. This lets analysts include data from risky sign-ins within the broader context of XOps investigations. The Cato Entra Identity Alert engine creates a story by correlating data from Entra ID Protection alerts that occurred for the same user within a 24-hour period.

For more about integrating Entra ID Alerts with Cato XOps, see Microsoft Entra ID: Configuring the XOps Integration.

Cloud Detection and Response: Uses Wiz issues to detect risks in cloud environments. This includes insecure configurations, vulnerable applications, exposed credentials, and threat detections. The producer processes Wiz issues in near real time and generates stories in the Stories Workbench. These stories combine Wiz cloud intelligence with Cato context, helping you investigate cloud risks and identify possible cross-environment attacks.

Cato Endpoint Alerts - The Cato EPP solution integrates with Cato XOps to generate stories for endpoint devices. The Cato Endpoint Alerts producer creates a story by correlating data from all Cato EPP alerts that occurred on the same device within a 24-hour period. Cato Endpoint Alerts stories include all relevant evidence detected by Cato EPP.

For more about Cato Endpoint Alerts stories, see Cato Endpoint Protection (EPP): Configuring the XOps Integration.

SentinelOne Alerts - Customers who use SentinelOne can integrate data from SentinelOne EDR to generate stories for endpoint devices. The SentinelOne producer creates a story by correlating data SentinelOne EDR incidents based on the Agent UUID (Device ID) and the threat file Hash within 90 days. These stories include all relevant evidence for the incidents detected by SentinelOne. Stories are created in near real-time after the original alert is generated.

For more about integrating SentinelOne Alerts, see SentinelOne EDR: Configuring the XOps Integration.

CrowdStrike Alerts - Customers that use CrowdStrike can integrate data from CrowdStrike detections based on the Incident ID. These stories include all relevant evidence for the detection identified by CrowdStrike. Stories are created in near real-time after the original alert is generated.

For more about integrating CrowdStrike Alerts, see CrowdStrike: Configuring the XOps Integration.

Site Operations - Cato XOps features the unique AIOps producer called Site Operations (formally known as Network XDR) that converges Network operations with Security operations into a single platform. This producer detects different indications and metrics related to connectivity and performance, and generates stories that correlate data for issues concerning the network. For example, if a WAN link is intermittently experiencing high packet loss, the producer creates a single story with all the relevant data for the link.

For more about Network stories in Cato XOps, see Reviewing Site Operations Stories.