• 530,410 Members
  • 1,381 Online
  • 1,133,720 Posts
  • 19,886 Solutions
  • 53,870 Likes

Welcome to Palo Alto Networks LIVEcommunity

Find answers, share solutions, and connect with peers and thought leaders from around the world.
New to LIVEcommunity? Check out our Welcome Guide.

Community Activity

XDR Automation Rules not triggering Playbook execution

I am experiencing an issue with XDR Automation Rules when attempting to execute a script. I have configured an automation rule to trigger a Playbooks when a specific event occurs. The Playbook is designed to run the built-in Quick Action: “Run Endpoint Script”, which executes a script registered in Action Center > Scripts Library. However, th...

.522643 by • L1 Bithead
  • 1069 Views
  • 3 replies
  • 0 Likes

armoury xsoar

I am trying to access Xsoar for case surveys, right now it says I am unauthorized. please point me in right direction if this is not the place.

Welcome to LIVEcommunity's 2026-2027 Cyber Elite Program!

6 min read

LIVEcommunity created its Cyber Elite Program to recognize experts in our community from around the globe who demonstrate excellence in participation and contributions. This innovative program is part of Palo Alto Networks commitment to empower outstanding members who enrich our global online community. About the Cyber Elite Program Cyber El...

cyber_elite_2026_2027_landing_banner_light_v2_1600x250.jpg
LIVEcommunity Cyber Elite.png
Expertise.png
Tone.png
IrynaC by • Community Manager
  • 34370 Views
  • 4 replies
  • 9 Likes

XDR Collector Status on Dashboard

Hi Everyone, I'm having trouble finding a way to create a widget displaying the XDR Collector status and create a custom correlation rule for a disconnected XDR Collector. I'm not able to find the correct dataset to use in the query. I used Agentic Assistant and was not able to generate the query correctly Is this feasible on Cortex XDR Pro?

PA-5450 Dataplane CPU Utilization Discrepancy (GUI vs SNMP)

Attention: Global TPM team, Hello, Could you please clarify the relationship between the Dataplane CPU utilization shown in the GUI and the SNMP CPU OIDs on a PA-5450? It was observed that the GUI shows approximately 80% Dataplane CPU utilization, while hrProcessorLoad.2 (1.3.6.1.2.1.25.3.3.1.2.2) returns only 5-10%. Could you please con...

Nimbus by • L1 Bithead
  • 90 Views
  • 2 replies
  • 0 Likes

SCM-managed log forwarding, no way to enable “Cloud Logging” checkbox from SCM?

Firewalls are fully managed by SCM, so we avoid any local config. I set up a Log Forwarding profile in SCM (Objects > Log Forwarding) for system logs. It pushes down fine and shows under Device > Log Settings > System on the firewall, but the “Cloud Logging” checkbox is unchecked, and I can’t find any way to enable it from SCM. So logs ...

External Entra-ID users gets 'Something went wrong'

I have an external guest who gets a Microsoft error while logging into GP. The error simply states "Something went wrong please try again" In the GP logs, I see On the Entra-ID logs, nothing. I asked the user to uninstall/reinstall the GP client, but the user in overseas so I wont hear back until tomorrow. I'm running panos 11.2.16 and GP...

MSullivan271926_0-1793118978670.png

SSL Decryption Causing Issues with Office 365

Currently working on a deployment with a few test users utilizing SSL decryption before it's rolled out to a wider user base. Decryption is working for the most part with the required exceptions in place, but having some issues with O365 apps no longer working after it was implemented. I had created an EDL and also explicitly added some Micros...

DJ_1924 by • L2 Linker
  • 120 Views
  • 4 replies
  • 0 Likes

[SOLVED] Prisma Access - Some Websites Are Unaccesible When Connects Only to Colombia Central Gateway

Hello, LiveCommunity team! I'm writing to share my experience regarding a web access error that occurs when our mobile users are connected to our "Colombia Central Gateway," which is deployed via SCM. When users connect to the "Colombia Central Gateway" and attempt to access the following websites: bancodeoccidente.com.cobancodebogota.com/person...

DanielSRomero_1-1793126043378.png

DecryptSSL Inboundwith SSL app no

I have just configured SSL Inbound for two servers and I'm seeing some unusual behavior. I can see random connections where the SSL "decrypted" flag is set to "NO" for SSL application. However, when the application is web browsing, it is always set to "YES".

Decrypt.jpg
BigPalo by • L4 Transporter
  • 139 Views
  • 2 replies
  • 0 Likes

Critical Recommendations for Deployment Guides: How to Secure the Management Access to your Palo Alto Networks Device

3 min read

Protecting your network begins with a secure firewall deployment. It is very important to secure the management interface and management network to prevent exploitation. So even when an attacker knows the login credentials of your devices, you can still prevent them from getting in. Best practice is to use the out-of-band (mgt) port for the fi...

Critical-Recommendations_palo-alto-networks.jpg
kiwi_2-1644404311924.png
kiwi_3-1644404637500.png
kiwi_4-1644405391906.png
kiwi by • Community Team Member
  • 242193 Views
  • 11 replies
  • 25 Likes

SDWAN alerts email notifications

Hello - can anyone point me to the steps to send email notifications for when SDWAN devices and sites generate alerts? We have hunted all over Strata Cloud Manager, and have successfully sent test emails via the "Incidents" configuration area, but we cannot figure out how to tie the SDWAN ION devices and SDWAN sites (both branch and data cen...

Upcoming Fuel Events

Top Solution Authors
Top Contributors