Unit 42 Threat Intelligence is Palo Alto Networks’ approach to helping organizations reimagine how they use threat data in day-to-day security operations.

Instead of just providing more indicators and alerts, Unit 42 focuses on turning fragmented data into curated, high-confidence intelligence that security teams can act on quickly.

It combines two core components built on a shared intelligence foundation:

• Cortex XTI (eXtended Threat Intelligence) – an operational intelligence layer that embeds Unit 42 insights directly into SOC tools and workflows, so analysts can investigate, hunt, and respond without jumping between disconnected feeds.
• Unit 42 Threat Intel Services – direct access to Unit 42 analysts for frontline expertise, tailored guidance, and strategic support.

Under the hood, Unit 42 is powered by:

• Global visibility at scale: visibility across 38 million telemetry signals from more than 70,000 customers, analyzing billions of events and 9 million novel threats daily.
• Frontline experience: lessons from thousands of incident response engagements, which provide real-world adversary context, not just raw indicators.
• AI-scale analysis + human expertise: automated analysis fused with expert review to continuously update and refine threat insights.

The outcome is intelligence that helps you:

• See which threats actually matter to your environment.
• Understand attacker behavior and tactics.
• Translate intelligence into faster, more confident defensive actions.

Cortex XTI is designed to help your SOC reshape how it operationalizes threat intelligence by embedding Unit 42 insights directly into the tools and workflows analysts already use.

Instead of treating threat intel as something separate from daily operations, Cortex XTI acts as the operational intelligence layer for the Cortex platform. It brings together:

• Unit 42 curated intelligence
• Global telemetry from Palo Alto Networks
• Your organizational context
• Agentic reasoning to connect signals and surface what matters

Key ways it helps your SOC:

• Embedded in investigation workflows: Intelligence is available where analysts investigate, hunt, and respond, reducing time spent pivoting across tools.
• Relevant threat mapping: Cortex XTI maps threats to your specific environment, so teams can focus on the risks that are actually present in your organization.
• Accelerated investigations: By combining high-fidelity intel with context, analysts can reach decisions faster and with higher confidence.
• Automations and playbooks: TI-based playbooks and automations help turn findings from indicators and alerts into consistent, repeatable response actions.

In practice, this means your team spends less time sifting through raw data and more time taking targeted, informed action.

Unit 42 Threat Intel Services give you direct access to the analysts and experts behind the intelligence that powers Cortex XTI, so you can align threat insights with your specific business and risk profile.

The services are offered through complementary options, allowing you to choose the level of engagement that fits your needs. Capabilities include:

• Frontline analyst access
  • Analyst on-demand and 1:1 briefings for deeper context on threats, campaigns, and incidents.
  • Designated Threat Intel Analyst to help tailor intelligence to your environment.
• Threat profiling and research
  • Threat profile assessments to understand which adversaries and techniques are most relevant to you.
  • Threat actor and malware profiles for insight into behaviors, tools, and likely targets.
  • Emerging threat research to stay ahead of new campaigns and malware families.
  • Deep and dark web service to better understand adversary activity and intent.
• Operational intelligence support
  • Automated IOC management and targeted alerting to reduce noise and highlight what matters.
  • Behavioral threat analysis to move beyond static indicators.
  • TI-based playbooks and automations to help operationalize intelligence in your workflows.
  • Ask 42 AI and agentic malware analysis (xMRE) for advanced, analyst-informed analysis at scale.

Together, these services are designed to help you:

• See what matters: prioritize the threats most relevant to your organization and improve analyst productivity.
• Understand the adversary: gain insight into attacker behavior to support faster, better-informed decisions.
• Operationalize intelligence: turn intel into faster defensive actions that strengthen your overall security posture and cyber resilience.