ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “cortex xdr”

3 items in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 1Research 1Tools 1
SeverityAllcritical 0high 0medium 0low 0info 3

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.

Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.

Palo Alto Unit 42 · 4d agoResearch1

12 Best CDR Solutions Compared (2026): Features & Pricing

A 2026 buyer's guide compares 12 cloud detection and response platforms on coverage, response speed, pricing transparency, and free-tier leverage.

GBHackers published an editorial scorecard of 12 CDR solutions including Sysdig, CrowdStrike, Wiz, Palo Alto Networks, Microsoft Defender, Permiso, Stream.Security, and Skyhawk. Open-source Falco is scored as the free runtime-detection floor, with weighted scores led by Sysdig (4.45) and Microsoft Defender (4.35). The guide contrasts per-workload, credit, and quote-based pricing and highlights specialists focused on cloud identity and real-time response.

GBHackers · 6h agoTools 10 sources

Top 10 Best Cloud Detection & Response (CDR) Solutions in 2026

Editorial scorecard ranks ten 2026 cloud detection and response platforms; Sysdig, Wiz, and CrowdStrike lead, with Wiz's Gem Security acquisition highlighted.

The editorial scorecard rates ten CDR platforms on real-time detection (30%), cloud telemetry depth, response automation, correlation, and value. Sysdig earns the best real-time detection score for its Falco- and eBPF-powered runtime telemetry, Wiz (8.7) folds acquired Gem Security's real-time CDR into its security graph, and CrowdStrike (8.7) leads response automation. Specialists Stream.Security, Skyhawk Security, Sweet Security, and the open-source Falco project are also assessed.

Cyber Security News · 2d agoIndustry1