Lumen expands managed detection and response with Cortex XSIAM integration

Lumen Technologies has announced Lumen Defender Advanced Managed Detection and Response (AMDR) for Palo Alto Networks Cortex XSIAM.

Attackers are increasingly operating earlier in the lifecycle while AI is accelerating threat speed. This expanded service will bring together Lumen’s managed detection and response capabilities and Lumen Defender Threat Feed powered by Lumen’s Black Lotus Labs network-embedded threat intelligence with Palo Alto Networks Cortex XSIAM AI-driven SOC platform to help enterprises modernize security operations, reduce alert fatigue, and accelerate detection and response so they can identify, contain, and disrupt increasingly complex threats.

“Cyber defense is a speed game, and the network is where threats often show up first,” said Lumen’s Chief Technology and Product Officer, Jim Fowler. “With Palo Alto Networks, we’re again raising the bar for security by expanding access to our high-value network threat intelligence and putting it to work through modern, automated operations. As we bring Lumen Defender AMDR to more partners and platforms, more customers can quickly thwart bad actors.”

Empowering customers with network embedded threat intelligence

A standout feature of this solution is its integration of threat intelligence from Lumen’s elite threat research arm, Black Lotus Labs, whose work is trusted by government agencies and industry partners. Unlike traditional threat intelligence that relies on endpoint or log telemetry, the Black Lotus Labs Threat Feed derives insights from activity observed across the Lumen network, providing early visibility into attacker infrastructure and behavior. This network-level visibility enables detection of pre-compromise activity, such as reconnaissance or staging, before attacks reach customer environments.

Black Lotus Labs not only protects Lumen’s network and security solutions, including Lumen Defender AMDR, but also disrupts large-scale cyber campaigns targeting U.S. agencies and global enterprises, ultimately shaping the security posture of the broader market.

“Securing the modern enterprise means eliminating complexity and accelerating time-to-resolution,” said Simone Gammeri, Chief Partnership Officer at Palo Alto Networks. “Combining Lumen’s network-level threat intelligence with Cortex XSIAM empowers organizations to proactively defend against sophisticated threats at machine-speed and scale their security operations.”

Automated defense, accelerated response, earlier visibility

Unifying functions within a single platform, Lumen Defender AMDR for Palo Alto Networks Cortex XSIAM operationalizes intelligence-driven detection, investigation, and response. It is designed to reduce tool sprawl, eliminate console switching, and accelerate incident response through automation and advanced analytics. It also supports both comanaged and fully managed SOC models, enabling organizations to modernize operations without replacing existing security teams.

Lumen Defender AMDR for Cortex XSIAM is designed for:

• Reduced alert fatigue with smart grouping and high-confidence alerts instead of raw signal noise
• Accelerated threat scoping and triaging
• Clear visibility into emerging and pre-compromise activity
• Faster decision-making with relevant threat context
• Standardized evidence-based investigation and response execution
• Less reliance on specialized in-house SOC talent
• Lower day-to-day operational complexity by leveraging agentic workflows
• Increased confidence in ongoing security coverage
• Simplified pricing and operations with fewer tools, contracts, and handoffs