Security Operations

Browse the Community

Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

1801 Posts

Cortex XSOAR Discussions

Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

952 Posts

Cortex Xpanse Discussions

Cortex Xpanse builds a system of record that is the authoritative source for an organization’s global Internet assets; it knows your attack surface so you can own it before someone else.

6 Posts

Cortex XSIAM Discussions

Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.

14 Posts

Query to detect any file/folder that are being hidden

Hi All,

Can someone please share the query to detect if any file or folder is being hidden?

Regards,

Shahwaz

Unable to add multiple folders in exclusion list

Hi Team,

Am unable to add multiple folders under Exception configuration page. I have 20+ folders which i need to exclude in Cortex XDR, i went to Exception Configuration-->Disable Prevention policy-->Add Rule. I have to do this each every time for e

...

Remove enopoint XDR Cortex

Can i remove XDR Agent from PC and i don*t have supervisor password for disable antitampering...

Endpoint are not showing in XDR Console...

please help, i have problems with cca 200pc

best regards...

Host Doesn't Appear in Main Account

Hi all,

I have a multi-tenant production and i have created a host but this host doesn't appear in the hosts in the main account.

How can i fix this problem?

Linux RHEL kernel support isn't fast enough - problem

Hello,

After using Cortex XDR on Linux RHEL for several months, we've observed that the support turnaround time for new RHEL kernels (from RHEL 6 to 9) is highly unpredictable. This can range anywhere from 2 to 10 weeks. Without supported ker

...

Delete File from War Room

Hi everyone,

I would like to ask is it possible to permanently delete the downloaded file in War Room? My team wants to make use of the Jobs function in XSOAR to handle files, and the file should be deleted in XSOAR after handling it.

Thanks,

Eliza

System Diagnostics and Health Check content pack

Hi,

I want to execute health check playbook which is a part of System Diagnostics and Health Check content pack. I followed the steps mentioned in this document----- https://xsoar.pan.dev/docs/reference/packs/system-diagnostics-and-health-check
When

...

Resolved! .csv format change

Hi,

I've just noticed this recently. A while ago when I added .csv file to a report, it was formatted with coma between columns. Now it is using a tab what cusses export to Excel more difficult. Is any setting which can be use to change it back?

Resolved! Looking for a XQL query to identify if a specific domain is accessed in our environment.

I have tried using the below XQL query to identify the domains accessed and tried to test it using my own system but somehow I am not getting all the results. For eg : when I tried common domain names like "google.com", "reddit.com". It worked and fe

...

Monitor and Collect Enhanced Endpoint Data in XDR

When setting the Agent profile in Cortex XDR, Under the check box when enabling "Monitor and Collect Enhanced Endpoint Data" is the following note:

Note: Before enabling enhanced endpoint data collection make sure your Strata Logging Service storage

...

Resolved! Vulnerable applications under Windows

Hello dear community,

is this now the long awaited feature, which gives us the possibility to have a CVE-scoring on Windows applications?

Rob

Resolved! Why Task Manager - Prompt the Alerts: Behavioral Threat

Dear All,

Do you know why the content updated, cannot open the task manager?

Cortex XDR

            "ruleId": "bioc.masqueraded_process_msft",
            "fileIdx": 0,
            "modules": [],
            "profile": "Malware",
            "sockets"

...

GoQR.me QR Code Reader misbehaving

I have an XSOAR 8.5 instance with a playbook which makes use of the GoQR.me QR Code Reader integration.

It had been working nicely in the playbook for months, but has begun to misbehave.

In the playbook, images are extracted from a phishing email a

...

Resolved! Legacy agent exception and Disable prevention rule

What is the difference between Legacy agent exception and Disable prevention rules?

This was asked in another discussion but the answer does not resolve the question asked (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/exception-and-e

...