topic Re: Cortex XDR Pathfinder in Cortex XDR Discussions

Cortex XDR Pathfinder

OrkanAlibayli — Wed, 21 Apr 2021 11:10:35 GMT

I dont really understand logic behind PATHFINDER. I installed Broker VM and configured pathfinder. But i can not see anything in Pathfinder Collection Center. I can not find answers to my questions in documentations. Can anybody please explain about pathfinder?

Re: Cortex XDR Pathfinder

fmoixsante — Wed, 21 Apr 2021 11:34:44 GMT

Hi @OrkanAlibayli ,

To be able to use Pathfinder, you need to first have a Cortex XDR Pro per TB license and have your PAN NGFW send logs to Cortex Data Lake. Also, Pathfinder is only able to gather information from Windows endpoints.

Do you have the above requirements? Please do also follow this article for Pathfinder. Activate Pathfinder (paloaltonetworks.com)

Re: Cortex XDR Pathfinder

OrkanAlibayli — Wed, 21 Apr 2021 12:07:27 GMT

Hi @fmoixsante . Thanks for your answer.

We have Cortex XDR Pro per TB license. And i also followed Activate pathfinder.

But our NGFW dont send logs to Cortex Data Lake

My questions are these:

when pathfinder begin gather information from Windows endpoints?
How pathfinder gather this information without any agent?

Thanks!

Re: Cortex XDR Pathfinder

fmoixsante — Thu, 22 Apr 2021 09:54:17 GMT

Hi @OrkanAlibayli ,

You need to send your PAN NGFW logs to CDL so that whenever Analytics get trigger, Pathfinder will then try to gather information from the involved endpoint/s.

Re: Cortex XDR Pathfinder

ESJosephPrinz — Fri, 03 Sep 2021 20:57:08 GMT

This pathfinder thing has been a real pain. I was told via a support ticket to identify devices without XDR on it I needed to:

Install Broker VM

Install Network Mapper

Install Pathfinder

I was told when net mapper does a scan it will identify devices and then pathfinder will run its script on them.

This business of NGFW logs seems irrelevant. Although, we do send all of our pan logs to the cortex lake.

Since installing pathfinder, I have not seen any activity in the collection center. In fact I purposely placed a windows 10 device without XDR on it on the same network range Net Mapper scans and pathfinder isnt doing a thing. When I look at pathfinder logs all I see are my "tests".

What is the point of network mapper if it doesnt pass on new devices to the asset manager?

What is the point of pathfinder if no alerts are sent for it to interrogate.

Where is the palo alto documentation on these items that we paid for? All there is is install guides less than a page long.

I am tired of opening tickets and getting support people who clearly know nothing about this.

Yes, I am aware the new cortex has what appears to be a peer to peer agent scan for devices process. Lets just say I dont want to use that method. For one the documentation says it will discover MAC and Platform only, I want the name of the unprotected device. Perhaps the doc is wrong but I still want to know after spending all this time setting up these services why they are not working.

Re: Cortex XDR Pathfinder

joseph.lim — Fri, 13 Jan 2023 02:20:59 GMT

Is there any reply to ESJosephPrinz? The frustration is real.

Re: Cortex XDR Pathfinder

bbarmanroy — Fri, 13 Jan 2023 04:04:44 GMT

Hi @ESJosephPrinz as @fmoixsante mentioned - Pathfinder will only trigger a deployment of a dissolvable agent on the target endpoint/s which do not have Cortex XDR, when an Analytics event of High/Medium severity is triggered.
The POC that you performed does not mention if the pre-requisites specified in the documentation are met.

Have you had a conversation with your Customer Success teams or Account representatives to get further clarity on this over a call/demo as it is more interactive than a forum? I am sure all of these questions can be addressed with proper context.

Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Activate-Pathfinder

Re: Cortex XDR Pathfinder

mabutbul — Mon, 23 Jan 2023 15:30:05 GMT

hey,

My name is Mickey im with the Technical Marketing Engineering team of Palo.

i am looking into this thread and trying to activate the pathfinder on my end and i would like to go on a session with the customer here.

can you send me email please so we can schedule?

mabutbul@paloaltonetworks.com

@ESJosephPrinz @OrkanAlibayli

thanks