SLS is required for Ingesting NGFW logs?

Hello all,

I have Pro per GB in my Cortex XDR and wish to gain more visablity in Network.
Is it compulsory to have Strata Logging Service license in order to make this works?
does Strata Logging Service license comes with my Firewall subscription or do

Brand new domain go to sinkhole

Hello. I am currently using Prisma GlobalProtect and am aware of the EOS notice.

I recently purchased a new domain (.ai), set it up on AWS, and began development. However, when connecting Prisma GlobalProtect, access to the domain fails. Upon checkin

External Web Proxy

Hi.

Have someone working with next hop fwd proxy ? 

I need post firewall solution for additional files types blocks (like Trellix)

8.9 On-prem Install Documentation Confusion

Hello, I'm trying to install our extra-small single server on-prem 8.9 XSOAR and ran into some confusion with the documentation. I didn't see a way to report the issue elsewhere so I thought it might be helpful here.
https://docs-cortex.paloaltonetwor

Create SSL VPN on PA-500

Hello. Week ago friend of mine gave me an old PA-500 w/o license and subscrption.

Since I had no admin pass therefore device was factory reseted. As Internet firewall device work fine now. Do somebody know is it possible to make

Powershell Modules in Xsoar Cloud

Hi,

I am trying to integrate with our Microsoft Defender instance from Xsoar Cloud. Right now I am trying to create a playbook task to add an item to the Tenant Allow Block List (TABL). Looks like the only way is via Powershell. I have a script that

I want to run Kaspersky VPN traffic through GlobalProtect VPN. Is this possible?

I'm trying to to run VPN traffic from Kaspersky through GlobalProtect, but when I have them both running and look at my IP, it still shows as the IP provided by Kaspersky and not the GlobalProtect IP. Is there a way to do this with Kaspersky? Otherwi

How to "empty" a field value in XSOAR, or remove the value?

Tried to remove a value of a field to "empty" 

For example "setIncident fieldname=None and !setIncident fieldname="" 

But that doesn't work, does anyone how how to remove the value? 

DR to DC failover completed; DR acts as back up server as expected but in DR "Make this the production server option is not grey out"

Hi Team,

The customer has did the DR to DC failover but DR backup server has " Make this the production server" tab enabled blue.

The client pointing that the option show be disabled. If it is enabled, any person can make backup server as production

Changing Multiple Docker Images at once

Hey,

We are offline users

We updated from 6.12 -> 6.14, Then after the update, the docker images changed, and it's causing a lot of ": Script failed to run: failed to pull docker Image "demisto/python 3:3.11.10.113941"

Now, to fix it I need to chan

Cortex XDR Get Incident API function 'hosts':None

I'm currently testing the api for Cortex XDR, in particular the 'get_all_incidents' function under '/public_api/v1/incidents/get_incidents' url.

Reference : https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Incidents

While test

bulk broker vm modifications

Hello,

we did a tenant migration and for some reason a lot of broker VM settings are still pointing to the old one.

We were wondering if it was possible to change the settings for it in bulk.

Thank you for your inputs.

PAN-184708 known issue

PAN-184708 know issue  is closed report groups to create

and there workaround but isnt good idea with me,

that on all 11.1.any ,PAN-OS ... support if there other method to turn on this feature or if mandatory wait the hotfix just tell

GlobalProtect 6.3.3

Our vulnerability scanner for the last couple weeks has been reporting vulnerabilities for GlobalProtect that are remediated with an upgrade to 6.3.3, but other than the vulnerability acknowledgement from PA mentioning it I do not see any evidence of