WildFire runs in the cloud and analyses alert data from the XDR agent to check for behavioural threats.

WildFire is the engine that runs on the local agent and determines whether behavioural threats are occurring on the endpoint.

WildFire accepts and analyses a sample to provide a verdict.

WildFire runs entirely on the agent to quickly analyse samples and provide a verdict.

Support exception

Local file threat examination exception

Behavioral threat protection rule exception

Process exception

BTP injects into known vulnerable processes to detect malicious activity.

BTP runs on the Cortex XDR and distributes behavioral signatures to all agents.

BTP matches EDR data with rules provided by Cortex XDR.

BTP uses machine Learning to recognize malicious activity even if it is not known.