• 528,655 Members
  • 3,741 Online
  • 1,132,830 Posts
  • 19,811 Solutions
  • 53,707 Likes

Welcome to Palo Alto Networks LIVEcommunity

Find answers, share solutions, and connect with peers and thought leaders from around the world.
New to LIVEcommunity? Check out our Welcome Guide.

Community Activity

Http logs collector example not working

Hihope this is the right place to ask this questionWe were given a temp user to play around with the Cortex XDR and we are trying to insert some dummy data into it.I am trying to insert data using an Http logs collector, following this guideunfortunately, the example in the guide seems to be incorrect. I created a custom collector of HTTP type a...

Cortex XDR & Prisma Browser integration

Hi Team, We’ve just finished deploying Cortex XDR and Prisma Browser across all endpoints for a customer. I’ve seen a few blogs mentioning an integration between the two that provides enhanced security event visibility, including browser data. Has anyone implemented this integration? Is it available, and if so, how can it be set up? Regard...

Resolved! Disable legacy automation rules

Hello, Currently in our xdr tenant, many issues have been getting automatically closed by legacy automation rules, rules migrated from XDR v3.x to v5,x. The problem is that these rules have conditions such as, category=Malware and detection method = XDR Agent whichr esults in legitimate security incidents being closed without analyst review. ...

Custom Scan Cortex XDR

Hello, I have a few questions regarding the Custom Scan functionality on Windows endpoints, and I have not been able to find the answers in the available documentation. First, I understand that Custom Scan has a limit of 100 items per scan. However, I have noticed some unexpected behavior when running scans: When I select only one file, the el...

Browser Threat Brief: Utility Extensions Turn Browsers Into Residential Proxy Nodes

5 min read

By: Tuan Vu Browser extensions are often installed to add simple functionality to the browser. But the permissions granted to those extensions can also give third-party code access far beyond the feature users expect. Browser extensions can silently use the access users grant them to do far more than the feature they advertise. Researchers...

tuvu01_0-1792147093499.png
tuvu01 by • L3 Networker
  • 47 Views
  • 0 replies
  • 0 Likes

Global Regulatory Mandates for Web Isolation and Secure Browsing

7 min read

For executives and technology leaders, securing the enterprise perimeter against sophisticated web-based threats while maintaining workforce productivity is no longer a best-practice conversation — it is a regulatory imperative. Governments and regulatory bodies across Asia-Pacific and North America and other countries have recognized the vulner...

moe_4-1792145583943.png
india.png
Singapore.png
South Koreq.png
moe by • L1 Bithead
  • 82 Views
  • 0 replies
  • 0 Likes

Factory Reset / Secure Erase - Removal of certificates and backup files

Attention: Global TPM team, Could you please confirm whether Factory Reset and Secure Erase (DoD/NNSA Scrub) remove the following data? - Imported certificates (including associated private keys) - Configuration snapshots - Configuration backup files stored on the firewall If available, could you also provide any documentation or internal ...

R.Tabira by • L1 Bithead
  • 54 Views
  • 1 replies
  • 0 Likes

Clarification on Security Policy and Decryption Policy Processing Order

Attention: Global TPM TeamHello Team, I am reviewing PAN-OS packet processing behavior related to Security Policy and Decryption Policy evaluation. Based on the public documentation below, I understand that Security Policy lookup occurs during session setup and that traffic matching a Decryption Policy can be decrypted for further inspection...

R.Tabira by • L1 Bithead
  • 43 Views
  • 1 replies
  • 0 Likes

Clarification on SSL Inbound Inspection re-encryption requirement and certificate usage

Attention: Global TPM TeamHello Team, This is a general product behavior question. No configuration review or TSF analysis is required. Question 1 With SSL Inbound Inspection enabled, is the following deployment supported? Client ↓ HTTPS PA-440 ↓ HTTP BIG-IP (AWAF) ↓ HTTP Web Server Can PA-440 forward traffic as plain HTTP after decryp...

R.Tabira by • L1 Bithead
  • 41 Views
  • 1 replies
  • 0 Likes

GlobalProtect SSO Ad credentials

I need to configure the SSO credentials for GP. When the users introduce the domain credentials the GP connect atomatically. I was checking the Globalprotect Credential Provider in this link: https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000PNMr but I'm not completely sure I understand this. If I want users to use SSO...

BigPalo by • L4 Transporter
  • 37 Views
  • 0 replies
  • 0 Likes

IOT Content mismatch issue

The system is currently operating in Active-Passive mode. The issue is a mismatch in the IoT Content versions between the Active and Passive firewalls. Active: IoT Content 247-767 / Passive: IoT Content 177-607 Is there a way to synchronize the IoT content versions between the two?

qmso475 by • L3 Networker
  • 60 Views
  • 0 replies
  • 0 Likes

GlobalProtect Release for Ubuntu 26.04 LTS ?

Hello together.recently was the new Ubuntu 26.04 LTS release, until now the provided GlobalProtect client supports only Ubuntu 24.04:https://docs.paloaltonetworks.com/compatibility-matrix/reference/globalprotect/where-can-i-install-the-globalprotect-app?otp=linux#linux When can we expect the new GlobalProtect version for Ubuntu 26.04 ? Best re...

GP Agent Machine Certificate Check

Hello, I am trying to find out more information about a GP portal setting called Machine Certificate Check under Portal Configuration / Agent / Agent Config / Config Selection Criteria / Device Checks. I was hoping to use a machine certificate check outside of the authentication tab to allow or disallow machines based on user/user group, but I...

Upcoming Change: Telemetry Enablement for Eligible PAN-OS NGFWs

3 min read

Overview Palo Alto Networks is enabling device telemetry on eligible PAN-OS NGFWs to help improve threat detection, enhance visibility into device health, and accelerate support case resolution. This update is rolling out in three waves. If your firewall meets the criteria below, telemetry will be enabled automatically and no further action i...

Upcoming Change.png
gagsingh by • L2 Linker
  • 676 Views
  • 5 replies
  • 6 Likes

Upcoming Fuel Events

Top Solution Authors
Top Liked Authors
Top Contributors