You can review the status of the response actions both from the security event and from the Actions Tracker.

Traps 6.1 now extends data collection and sharing capabilities to Mac and Linux endpoints. When enabled to do so, Traps uploads endpoint activity data to the Cortex Data Lake. This information provides Cortex apps with the endpoint context so that you can gain insight into the overall event scope when you investigate a threat. This includes all activities that took place during an attack and the endpoints that were involved.

When you enable Traps to Monitor and collect endpoint events in your Agent Settings profile, you must also allocate log storage for Endpoint Data in your Cortex Data Lake instance.

Traps 6.1 now extends Behavioral Threat Protection to protect Mac and Linux endpoints. This enables Traps to monitor endpoint activity to identify and analyze chains of events—known as causality chains—instead of only evaluating a single event on its own. This enables Traps to detect malicious activity in the chain that could otherwise appear legitimate if inspected individually.

Palo Alto Networks defines the causality chains that are malicious as behavioral threat rules in the default policy and delivers any changes to the rules with content updates. While you cannot configure your own behavioral threat rules, you can configure the action Traps takes when it detects a match from a Malware Security profile in Traps management service. You can also configure Traps to quarantine the causality group owner (CGO) which initiated the activity when Traps detects a match.

(Windows only)

(Windows only)

(Windows only)

Traps management service now uses the trapsSeverity to calculate the Syslog severity based on the following enumeration mapping:

Previously, values were calculated independently and could be calculated by different sources. Synchronizing the two sources helps provide consistency and clarity between the two fields when you use the Log Forwarding app to forward logs to an external server that receives Syslog messages (or to an email server).

To enable you to manage roles for all Cortex apps in a single location, you now manage roles from the Cortex hub. Any existing users who were assigned roles in the Customer Support Portal and Traps management service are automatically migrated to Cortex hub. We recommend that you review the Cortex Hub Getting Started Guide and the roles assigned to your users following this migration of roles to Cortex hub to determine if any changes are required.

In addition, the Permissions page from which you managed role assignments in Traps management service is now removed.

(Traps 6.0 and later releases)

Traps for Linux can now prevent known and unknown malware on Linux servers by leveraging WildFire threat intelligence and local analysis to analyze ELF files. When an ELF file executes on the host server or within a container on the Traps-protected host, Traps automatically suspends the execution until a WildFire or local analysis verdict is obtained. When the verdict is malware, Traps prevents the process execution and reports the event to the Traps management service. If the ELF file is unknown to WildFire, Traps can also upload it to WildFire for further analysis.

For compatibility reasons, malware analysis of ELF files on Linux servers requires kernel 3.4 and later versions released before February 4, 2019. Linux servers running other kernel versions will operate in asynchronous mode where the agent will obtain a verdict for the executed ELF file in parallel to its execution and terminate it if a malware verdict is obtained.

(Traps 6.0 and later releases)

Traps can now enforce the following response actions on the endpoint:

If you also use Cortex XDR – Investigation and Response for complete visibility across Cortex XDR – Analytics and Traps, you can initiate the response actions from the Cortex XDR – Investigation and Response app. Traps management service coordinates with the Traps agent on the endpoint to enforce the response actions and tracks the action status.

(Windows 7 with SP1 and later releases and Traps 6.0 and later releases)

To expand Traps malware protection capabilities on Windows endpoints, Traps introduces the new Behavioral Threat Protection module. With behavioral threat protection, Traps continuously monitors endpoint activity to identify and analyze chains of events—known as causality chains—rather than a single event. This enables Traps to detect malicious activity in the chain that could otherwise appear legitimate if inspected individually.

Palo Alto Networks defines the causality chains that are malicious as behavioral threat rules in the default policy and delivers any changes to the rules with content updates. While you cannot configure your own behavioral threat rules, you can configure the action Traps takes when it detects a match from a Malware Security profile in Traps management service. You can also configure Traps to quarantine the causality group owner (CGO) which initiated the activity when Traps detects a match.

When Traps detects matching activity, Traps performs the configured action and reports details about the activities that led to the security event. You can review the entire causality chain up to the causality croup owner on the Analysis tab of a security event. If after analyzing the flow of events, you believe the behavior is legitimate, you can define a policy exception from the security event to disable to the behavior rule on the endpoint.

You can now define membership for a dynamic endpoint group based on the specific endpoint type (workstation, server, or mobile) or operating system version (for example, SUSE Linux 12.1). When you define an endpoint group for an operating system, Traps management service presents a list of operating systems and versions based on your registered endpoints.

After you define your endpoint group, you can use it to manage endpoints, apply policy, or apply exceptions to endpoints of a specific type or operating system version.