This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4536 Views
  • 0 replies
  • 3 Likes

Cortex XDR JDP method instrumentation causing severe Java runtime slowness (agent 9.2.0.120) — follow-up to solved cyjagent crash thread

This is a follow-up to a previously solved thread: Cortex XDR cyjagent.dll injection causes JVM startup crash, where @susekar confirmed the known JDP/JVM conflict (CPATR-38467 / CPATR-18158). Thanks for that confirmation. Since the solution there is already accepted, raising this as a separate topic: we've now observed a second symptom from the ...

Resolved! Cortex XDR cyjagent.dll injection causes JVM startup crash (EXCEPTION_ACCESS_VIOLATION in ntdll.dll)

We run an enterprise Java server application (Zulu OpenJDK 11, Windows Server) and are seeing consistent JVM crashes at startup on hosts protected by Cortex XDR. The agent injects cyjagent.dll (Java Deserialization Protection module) into the Java process, and the JVM crashes in native code: # EXCEPTION_ACCESS_VIOLATION (0xc0000005) # Problem...

Resolved! SBAC for DLP add-on

Hello All, Would SBAC also works for DLP (add-on) module events? We wou ld enable SBAC for those Endpoints with DLP enable by department. Then allow each department head as the Data Security Reviewer to view their own DLP events. Possible to do so? Thanks, SDH

Real-Time BIOC Detection and Playbook Execution for SSH/RDP Sessions

Hello, I am working on a Playbook to detect RDP/SSH communications between servers and automatically terminate the corresponding process when such communication is detected. As a preliminary test, I have configured a small-scale test to verify that the process can be automatically terminated. My current configuration is as follows. 1. XDR Enviro...

.522643 by • L1 Bithead
  • 76 Views
  • 1 replies
  • 0 Likes

Cortex XDR MITRE ATT&CK v16 -- We're Now on v19. Can We Talk About This?

Hey LIVEcommunity, I have been sitting on this for a while and finally decided to write it up because I am pretty sure I am not the only one running into this. If you are a detection engineer or SOC analyst building BIOCs in Cortex XDR and leaning on MITRE ATT&CK to organize your detection coverage, this one is for you. So Here Is What Ha...

D.Ogle by • L0 Member
  • 1572 Views
  • 3 replies
  • 6 Likes

Sending case to a third party tickiting system

Hello, i hope you re doing well i want to know the steps to send cases when there generated to our third party tickiting system , how to do it via API or weebhook. can someone already worked on a similare case share with me all the steps and configuration required. thanks in advance Cortex XDR

Resolved! Cortex XDR and Microsoft Defender Coexistence and Performance

Hello Cortex XDR Community,We recently were asked to have official guidance regarding the coexistence of Cortex XDR Agent and Microsoft Defender on Windows endpoints. My questions to the community and experts is: - Is the coexistence of Cortex XDR and Microsoft Defender Antivirus officially supported? - Is the coexistence of Cortex XDR and Micr...

XDR Not Recognising Hotpatches

We've started deploying WIndows Enterprise Hotpatches to speedup the adoption of patches and reducing the number of reboots required. Howver, XDR doesn't recognise the Hotpatches and is telling us that the endpoints are still vulnerable. This is a known "limitation" according to support. What are others doing in this space please?

I just received this alert "Script Activity - 245655498" with this description "Suspicious script with keywords written in a non-standard way." in Cor

I just received this alert "Powershell Activity - 2390140751 " with this description "Suspicious script with keywords written in a non-standard way." in Cortex multiple times related to PowerShell script execution on a developer machine. The executed scripts were different and I don't know why Cortex is blocking such executions. There is also no...

Multiple Cortex XDR Agent Upgrades Failing with "The installer has timed out" Error

Hi team, We are currently encountering a mass upgrade failure across multiple endpoints during both Auto Upgrade and Manual Server Upgrade attempts. While a single endpoint successfully upgraded using our standard profile and group configuration, the remaining endpoints consistently fail. Issue Summary: Symptom: The upgrade tasks transition to...

Z.Zikri by • L0 Member
  • 274 Views
  • 1 replies
  • 0 Likes

Resolved! Cortex XDR Pro – Does it scan USB devices upon insertion?

Hi team, I would like to confirm the behavior of Cortex XDR Pro regarding USB devices: Does Cortex XDR perform any automatic malware scan when a USB device is connected to an endpoint? If not, what protections are applied at connection time (e.g., device control, behavioral detection, execution monitoring)? Is scanning of removable media only p...

  • 2644 Posts
  • 101 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks