During a security event, the Traps agent (part of Cortex XDR) performs several actions beyond just preventing the activity:

Collects forensic information about the event: The Traps agent gathers detailed information regarding the event, which helps in understanding the nature and source of the threat.

Communicates the status of the endpoint to the ESM (Endpoint Security Manager): This communication ensures that the ESM is aware of the current state of the endpoint, helping in centralized management and response.

Notifies the user about the event: The agent informs the user about the occurrence of a security event, which can help in immediate local response and awareness.

References:

Palo Alto Networks Cortex XDR Documentation

Palo Alto Networks Traps Agent User Guide