topic Re: XDR policy targeting using AD in Cortex XDR Discussions

XDR policy targeting using AD

HafisM — Tue, 19 Jan 2021 06:53:08 GMT

Hi there,

When we are trying to target a policy using AD group some of the listed endpoints is not a member of selected group.

To get more clarity we selected a group which only contains users and even then the result listing some random endpoints.

Is it normal behavior or am I missing something here

how can we target policies using AD groups and can we do policy targeting on user level ( for Device control policy)

Thanks

Hafis

Re: XDR policy targeting using AD

jcandelaria — Tue, 19 Jan 2021 19:01:26 GMT

Once you create the Profile under Endpoint Management > Policy Management > Extentions Profile then you can now attach the profile to the policies in Extention

guide: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/apply-security-profiles-to-endpoints.html

In step 6: You can use the Active Directory filter column to select target endpoints (assuming your directory sync is setup and working properly).

guide: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-dir-sync.html

If you are using the Active Directory column when filtering a target and its not detecting the right endpoints, you can submit a case so we can further investigate it.

Re: XDR policy targeting using AD

HafisM — Wed, 20 Jan 2021 08:37:01 GMT

Thanks for reply jcandelaria,

It seems we have some issue within the directory sync

Will raise this issue with PaloAlto.

Thanks