Cortex XDR Live Terminal problem

OrkanAlibayli — Mon, 04 Oct 2021 13:58:19 GMT

Hello.

We have a problem about live terminal. When we we initiate live terminal session in endpoints ( all endpoints have same problem ) notification pops up ( about live terminal ) but we see 'operation time out' error in Cortex XDR web UI. Can anybody help about this situation?

Note: We give all accesses to endpoints as mentioned in this link.

Thanks.

Re: Cortex XDR Live Terminal problem

eluis — Mon, 04 Oct 2021 14:30:13 GMT

Hi OrkanAlibayli,

please check this doc with the requirements for the live terminal session and make sure you are compliant with that

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/response-actions/initiate-a-live-terminal-session

at the following document you will see how to at step 4 you can disable the notifications to the user. Please realize that this is just available for Windows and Mac endpoints.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/customizable-agent-settings/add-agent-settings-profile.html#id17AHKE0N00P_idd95abb59-1853-4ec3-b725-68b78465b400

I also hope that the following procedure helps:

Procedure
To investigate and respond to security events on Windows endpoints, you can use the Live Terminal to initiate a remote connection to an endpoint.

The Cortex XDR agent facilitates the connection using a remote procedure call.
Live Terminal enables you to manage remote endpoints.
Live Terminal is supported for endpoints that meet the following requirements:

Traps 6.1 or a later release
Windows 7 SP1 or a later release
PowerShell 5.0 or a later release
Windows update patch for WinCRT (KB 2999226)—To verify the Hotfixes that are installed on the endpoint, run the system info command from a command prompt.
Endpoint activity was reported within the last 90 minutes (as identified by the Last Seen time stamp in the endpoint details).

If the endpoint supports the necessary requirements, you can initiate a Live Terminal session from the Endpoints page. You can also initiate a Live Terminal as a response action from a security event. If the endpoint is inactive or does not meet the requirements, the option is disabled.

After you terminate the Live Terminal session, you also have the option to save a log of the session activity. All logged actions from the Live Terminal session are available for download as a text file report when you close the live terminal session.

Please dont forget to thumbs up if this answer was helpful.

KR,

Luis

Re: Cortex XDR Live Terminal problem

OrkanAlibayli — Mon, 04 Oct 2021 14:40:19 GMT

Hello Eluis,

Thanks for answer. All requirements in above is compatiable in our endpoints. But problem still going on.

Re: Cortex XDR Live Terminal problem

WSeldenIII — Mon, 04 Oct 2021 15:49:18 GMT

Hi @OrkanAlibayli

Palo Alto Networks is currently reporting Cortex XDR - Limited Functionality in Remote Terminal Services in Americas and Europe Regions. You may subscribe to the updates to monitor the status.

topic Re: Cortex XDR Live Terminal problem in Cortex XDR Discussions

Cortex XDR Live Terminal problem

Re: Cortex XDR Live Terminal problem

Re: Cortex XDR Live Terminal problem

Re: Cortex XDR Live Terminal problem