https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-the-cloud-identity-engine/m-p/1225429#M8165 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/80707">@mgreer</a>&nbsp;,</P> <P>&nbsp;</P> <DIV id="message-list_1743526699.780289" class="c-virtual_list__item" tabindex="0" role="listitem" aria-setsize="-1" data-qa="virtual-list-item" data-item-key="1743526699.780289"> <DIV class="c-message_kit__background p-message_pane_message__message c-message_kit__message" role="presentation" data-qa="message_container" data-qa-unprocessed="false" data-qa-placeholder="false"> <DIV class="c-message_kit__hover" role="document" aria-roledescription="message" data-qa-hover="true"> <DIV class="c-message_kit__actions c-message_kit__actions--default"> <DIV class="c-message_kit__gutter"> <DIV class="c-message_kit__gutter__right" role="presentation" data-qa="message_content"> <DIV class="c-message_kit__blocks c-message_kit__blocks--rich_text"> <DIV class="c-message__message_blocks c-message__message_blocks--rich_text" data-qa="message-text"> <DIV class="p-block_kit_renderer" data-qa="block-kit-renderer"> <DIV class="p-block_kit_renderer__block_wrapper p-block_kit_renderer__block_wrapper--first"> <DIV class="p-rich_text_block" dir="auto"> <DIV class="p-rich_text_section">AD -&gt; CIE is near-realtime (every 15-30 mins) and&nbsp; XDR is once every 24 hours, you can query the pan_dss_raw dataset and check the generatedTime field</DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> <DIV id="message-list_1743526715.788739" class="c-virtual_list__item" tabindex="-1" role="listitem" aria-setsize="-1" data-qa="virtual-list-item" data-item-key="1743526715.788739"> <DIV class="c-message_kit__background p-message_pane_message__message c-message_kit__message" role="presentation" data-qa="message_container" data-qa-unprocessed="false" data-qa-placeholder="false"> <DIV class="c-message_kit__hover" role="document" aria-roledescription="message" data-qa-hover="true"> <DIV class="c-message_kit__actions c-message_kit__actions--above"> <DIV class="c-message_kit__gutter"> <DIV class="c-message_kit__gutter__left" role="presentation">&nbsp;</DIV> <DIV class="c-message_kit__gutter__right" role="presentation" data-qa="message_content"> <DIV class="c-message_kit__blocks c-message_kit__blocks--rich_text"> <DIV class="c-message__message_blocks c-message__message_blocks--rich_text" data-qa="message-text"> <DIV class="p-block_kit_renderer" data-qa="block-kit-renderer"> <DIV class="p-block_kit_renderer__block_wrapper p-block_kit_renderer__block_wrapper--first"> <DIV class="p-rich_text_block" dir="auto"> <DIV class="p-rich_text_section">You will get a warning banner in the tenant after 72 hours of not syncing.</DIV> <DIV class="p-rich_text_section">&nbsp;</DIV> <DIV class="p-rich_text_section"><SPAN>If you feel this has answered your query, please let us know by clicking like and&nbsp; on "mark this as a Solution". Thank you.</SPAN></DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> Wed, 02 Apr 2025 06:31:21 GMT aspatil 2025-04-02T06:31:21Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-the-cloud-identity-engine/m-p/1225248#M8159 <P>Does anyone have a good method for generating an alert if the Cloud Identity Engine has failed to perform an on-prem or Azure sync in the last 24 hours?</P> Mon, 31 Mar 2025 20:20:05 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-the-cloud-identity-engine/m-p/1225248#M8159 mgreer 2025-03-31T20:20:05Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-the-cloud-identity-engine/m-p/1225429#M8165 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/80707">@mgreer</a>&nbsp;,</P> <P>&nbsp;</P> <DIV id="message-list_1743526699.780289" class="c-virtual_list__item" tabindex="0" role="listitem" aria-setsize="-1" data-qa="virtual-list-item" data-item-key="1743526699.780289"> <DIV class="c-message_kit__background p-message_pane_message__message c-message_kit__message" role="presentation" data-qa="message_container" data-qa-unprocessed="false" data-qa-placeholder="false"> <DIV class="c-message_kit__hover" role="document" aria-roledescription="message" data-qa-hover="true"> <DIV class="c-message_kit__actions c-message_kit__actions--default"> <DIV class="c-message_kit__gutter"> <DIV class="c-message_kit__gutter__right" role="presentation" data-qa="message_content"> <DIV class="c-message_kit__blocks c-message_kit__blocks--rich_text"> <DIV class="c-message__message_blocks c-message__message_blocks--rich_text" data-qa="message-text"> <DIV class="p-block_kit_renderer" data-qa="block-kit-renderer"> <DIV class="p-block_kit_renderer__block_wrapper p-block_kit_renderer__block_wrapper--first"> <DIV class="p-rich_text_block" dir="auto"> <DIV class="p-rich_text_section">AD -&gt; CIE is near-realtime (every 15-30 mins) and&nbsp; XDR is once every 24 hours, you can query the pan_dss_raw dataset and check the generatedTime field</DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> <DIV id="message-list_1743526715.788739" class="c-virtual_list__item" tabindex="-1" role="listitem" aria-setsize="-1" data-qa="virtual-list-item" data-item-key="1743526715.788739"> <DIV class="c-message_kit__background p-message_pane_message__message c-message_kit__message" role="presentation" data-qa="message_container" data-qa-unprocessed="false" data-qa-placeholder="false"> <DIV class="c-message_kit__hover" role="document" aria-roledescription="message" data-qa-hover="true"> <DIV class="c-message_kit__actions c-message_kit__actions--above"> <DIV class="c-message_kit__gutter"> <DIV class="c-message_kit__gutter__left" role="presentation">&nbsp;</DIV> <DIV class="c-message_kit__gutter__right" role="presentation" data-qa="message_content"> <DIV class="c-message_kit__blocks c-message_kit__blocks--rich_text"> <DIV class="c-message__message_blocks c-message__message_blocks--rich_text" data-qa="message-text"> <DIV class="p-block_kit_renderer" data-qa="block-kit-renderer"> <DIV class="p-block_kit_renderer__block_wrapper p-block_kit_renderer__block_wrapper--first"> <DIV class="p-rich_text_block" dir="auto"> <DIV class="p-rich_text_section">You will get a warning banner in the tenant after 72 hours of not syncing.</DIV> <DIV class="p-rich_text_section">&nbsp;</DIV> <DIV class="p-rich_text_section"><SPAN>If you feel this has answered your query, please let us know by clicking like and&nbsp; on "mark this as a Solution". Thank you.</SPAN></DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> Wed, 02 Apr 2025 06:31:21 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-the-cloud-identity-engine/m-p/1225429#M8165 aspatil 2025-04-02T06:31:21Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-the-cloud-identity-engine/m-p/1225476#M8171 <P>"You will get a warning banner in the tenant after 72 hours of not syncing."<BR />Is this in the Cortex XDR tenant or in the Cloud Identity Engine app of Cortex Hub?</P> <P>&nbsp;</P> <P>Thanks,</P> <P>Mike</P> Wed, 02 Apr 2025 16:41:19 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-the-cloud-identity-engine/m-p/1225476#M8171 mgreer 2025-04-02T16:41:19Z