topic Re: Cortex XDR Notifications in General Topics

Cortex XDR Notifications

b.sistemas — Mon, 22 Jul 2024 08:56:46 GMT

Hello community:

I have some doubts about Cortex XDR notifications. Currently, I have an alert set up to send me an email every time a device has the sub-type = Fully protected. My intention is to receive an email every time Cortex is installed on any device. I've been testing this alert, but it's not working as expected. It notifies me when a device is installed, but there's something else that triggers it too. Does anyone know what triggers this sub-type?

Also, how can I modify the alert email to include the endpoint ID?

Re: Cortex XDR Notifications

BPry — Tue, 23 Jul 2024 21:54:07 GMT

@b.sistemas,

You can have agents drop to partially protected and unprotected, so your alert will trigger whenever the device re-enters fully protected operational status. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Monitor-Agent-Operational-Status details more on why you might have something enter unprotected or partially protected states, but importantly for what you're doing it means that you'll receive more alerts than just "new device detected".

What I've done in the past for Cortex XDR and for any other EDR is script this through the API. Pull the entire device list and alert for any new device that wasn't previously detected. The last I looked at Cortex XDR and didn't just script the check, this alert wasn't something it could provide by itself.

Re: Cortex XDR Notifications

b.sistemas — Wed, 24 Jul 2024 12:28:24 GMT

The option you gave me didn't occur to me, the problem is that I have notifications set up from the Notifications section and in that section, the Operational Status field does not appear, so I cannot receive that notification in that way.

As for the protected status, it's something strange because I tried uninstalling and reinstalling Cortex on a machine to see if I could see it change state, but I haven't found any place to monitor the operational status of an agent.