Traditional SOC automation and agentic AI tools often stop at Level 1 and Level 2 tasks, focusing only on summarizing logs, triaging alerts, and offering basic recommendations. When it comes to deep cross-correlation and actual containment, senior analysts are still left doing the heavy lifting manually.
We will demonstrate how to configure and deploy a Level 3 (L3) Response Agent in Cortex XSIAM to move beyond passive advice and execute end-to-end, multi-source investigation and remediation.
In this session, you will learn how to:
- Move beyond static recommendations to execute direct containment actions, including host isolation, token revocation, and account disabling.
- Correlate multi-source telemetry across both native Cortex components and third-party tools like Active Directory, Tivoli and CrowdStrike.
- Apply contextual reasoning to accurately differentiate active attacks from operational false positives or policy misconfigurations.
- Implement human-in-the-loop safety controls with mandatory approval gates before high-impact response actions execute.
Connect with our experts, explore real-world use cases, and walk away with a clear roadmap to modernize your organization with best-of-breed AI capabilities.Â
This session is ideal for security analysts of all experience levels, including security operations/SOC staff and incident responders.
Regional Field Chief Security Advisor, West and Healthcare
Trevor Stuart is a Field Security Advisor at Palo Alto Networks, serving as a strategic architect for organizations modernizing their Security Operations Centers (SOCs). With over 20 years of deep technical experience, Trevor specializes in high-scale SOC transformation, leveraging Cortex XSIAM, AI-driven detection methodologies, and advanced log ingestion architecture to disrupt modern attack vectors.
Prior to his role at Palo Alto Networks, Trevor spent nearly 11 years at Microsoft in several elite capacities, including Senior Cybersecurity Global Black Belt. During his tenure, he was a trusted advisor for Fortune 500 enterprises, leading complex technical wins across Microsoft Sentinel, Defender XDR, and Zero Trust frameworks. His career is defined by a unique blend of "Secure by Design" engineering and consultative leadership, ensuring that global organizations not only deploy cutting-edge security tools but achieve tangible, resilient business outcomes.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur porttitor lacus a condimentum dictum. Proin efficitur lobortis leo vel sodales. Vivamus mauris enim, tempus ut sapien at, iaculis vestibulum dolor. Praesent vehicula, lacus ut ultricies pellentesque, ligula enim maximus urna, nec tempor eros mauris quis sapien. Suspendisse potenti. Nunc ac ornare dui. Aenean ultrices elit lectus, non viverra lectus malesuada a. Curabitur mattis tincidunt erat in gravida. Vivamus sit amet lacus egestas mi suscipit finibus. Aliquam ac urna libero.
