Cortex XDR Process Exclusions

We are deploying Cortex XDR to Windows servers initially in Report only mode and seeing memory Utiliziation on some servers ranging 500 MB- 1.2 GB. Is this considered to be normal?

Advise we receive was that we don't need to exclude ceritan process

Code signed executables

A colleague raised a query with regards code signing certificates?

For example if files are created, remodified and recompiled, the Sha256 will change every time, and these would need to be Whitelisted every time.

The question asked is if we are

custom scan with xdr agent for linux

Hi,

i would like to know if it's possible to do a custom scan for a specific file like we can with the cortex agent for windows but i would like to do it for linux.

I just see how to launch a global scan under linux but not a specific file.

Thanks

ERROR MESSAGE: This email is already registered with an account

Dear Team,
I recently created some users, but I made some mistakes with data entry, so I deleted 1 user, leaving me with 2 users to be deleted. I would like to recreate the deleted user with the right information. But I'm experiencing some issues with

Cortex XDR on Windows 10 LTSC

Hello,

We have not been able to install cortex XDR on a windows 10 LTSC machine. It starts to install but then fails. Is there a separate installation for Windows 10 LTSC machines?

Split nested JSON

I have a field named "ModifiedProperties" and it has values like this below, I cant for the life of me figure out how XQL splits these up, Splunk uses SPAN or MVexpand and it works like a champ but i cant figure out what function does the same thing

Cortex XDR - Blocked Hashes on newer systems do not show in Incidents

Hi,

As the name suggests we have blocked certain hashes on Cortex XDR. However when a some new system runs the blocked hash file(s), they do get blocked a prompt is also shown on the system but there is no incident on Cortex Incident tab. Why is it

How do i uninstall agent if my console license had expired?

I am having difficulty to uninstall Palo XDR agent, my Palo XDR console license had expired.

Palo Alto Cortex IIS API Query

Hello Everyone, 

We ingest IIS logs by querying Cortex using a custom-built sensor utility. Recently, we've started encountering a NullPointerException. Upon investigating in our test environment, we found that the issue is related to a field in th

Cortex XDR Linux Agnet version 8.7.0.131661

Hi Team,

We tried to install the XDR agent version 8.7.0.131661 on a Linux machine. The installation was successful, but the XDR services are all in a "stopped" status. We attempted to start all services using the command cytool runtime start all,

VSCode Very Slow with Cortex XDR installed

Hey all,

We deployed Cortex XDR a few months ago and since then our developers have been very frustrated with the performance of VSCode. 

When VSCode is launched the Cortex XDR Service on the system spikes heavily with CPU usage, and VSCode takes

Check Point Threat Emulation (SandBlast) integration with cortex

Hi everyone, i need help to solve this issue. Could you help me?

I accidentally installed Cortex XDR on a personal computer and I don't have uninstall credentials.

I accidentally installed Cortex XDR on my personal computer, and now I cannot uninstall it because I do not have the uninstall password or access token. I am not part of any organization and this is a personal PC. What should I do?

Child(?) Broker VM Setup

We are a semi-isolated environment with no internet connectivity, and have a customer requirement of having minimal network traffic between our environment and one with internet connectivity.

We are looking at implementing Cortex XDR on our environ