During a security event, the Traps agent (part of Cortex XDR) performs several actions beyond just preventing the activity:
* Collects forensic information about the event: The Traps agent gathers detailed information regarding the event, which helps in understanding the nature and source of the threat.
* Communicates the status of the endpoint to the ESM (Endpoint Security Manager): This communication ensures that the ESM is aware of the current state of the endpoint, helping in centralized management and response.
* Notifies the user about the event: The agent informs the user about the occurrence of a security event,
* which can help in immediate local response and awareness.
References:
* Palo Alto Networks Cortex XDR Documentation
* Palo Alto Networks Traps Agent User Guide