Move Cortex XDR agent from one tenant to another (and back)

When we move an agent to a new management server, what would happen to the logs and telemetries we have on the old tenant? Would they be retained as per the usual policy or would they just get purged?

Also if we then move it back to the old tenant,

How can I see if my FW has already been exploited by the CVE-2024-3400?

Hello team

How can we determine if your device logs match the known indicators of compromise (IoC) for this vulnerability?

I have already fixed the vulnerability and I have the TSF of my device and I want to see if I have been exploited before applyi

GlobalProtect and using split tunneling

Global protect has the handy feature of excluding select destinations from being sent over the vpn. For example, setting

(Split Tunnel - Domain and Application - Exclude Client Application Process Name) https://docs.paloaltonetworks.com/globalprotect/

Issues with pushing out 10.2.9-h1

There is not a community discussion for issues implementing 10.2.9-h1

We have a maintenance window to push out 10.2.9-h1 Thursday evening and with recent issues with 1.2.7.h3 and other roll outs i am starting this thread for the community.

Fast boot PA-450

I have a firewall that for some reason after doing a version update to 11.1 is only taking 2 to 3 min to boot now. I noticed all the logs were not showing up and the interfaces was showing down, but everything was working. I decided to do a factory r

SSO and MFA for Admin Access Only

For those who have implemented SSO and MFA for Administrator web access to firewalls and Panorama, what was implemented? Did you use SAML or Radius. Is Azure AD an acceptable IdP? What was used for MFA? 

Thank in Advance

IP sec tunnel

Hi Team,

We have multiple IP-sec tunnels and want to clean up unused tunnels.

Like we have the option of an unused rule for security policy, or we will know by its hit count, is there any similar way we can find out an unused tunnel so we can delet

TSF file upload

I am trying to open a case in the portal for one of our customers and the page is not working.  I have a TSF to upload as I believe our customer has evidence of exploitation of CVE-2024-3400

Global Protect - ARM client

As stated with this link, a client version of GlobalProtect for ARM has been released

GlobalProtect fails to connect on windows 11 ARM64 with error message: Could not connect to the GlobalProtect service.

As I migrated to a new machine (ARM process

Panorama fails to upgrade itself with error: Label sysroot1 does not indicate a valid image

Hi all,

      last time I tryed to upgrade my Panorama, I had this error: "Label sysroot1 does not indicate a valid image".

The panorama is working, also I'm able to upload images and content to managed firewall, only I cant upgrade itself.

Is not re

New Advanced URL Filtering category: Marijuana

Palo Alto Networks will release a new Advanced URL Filtering category called “Marijuana”.

ACTION: Action may be required. The default action for this new Marijuana category is “allow.” If you currently alert on or block marijuana websites (usi

Microsoft Defender Outbound traffic policy

Trying to slim down a rule for outbound traffic with clients using MS defender. I built a custom URL list of the defender urls provided by MS. Added it to the policy under service/url category. The apps used are ms-update, ssl, web-browser, windows-d

Multiple bogus credentials on GP portal

I have noticed there are alot of random IPs that are trying to login to my GP portal. We are using pre-login method of GP so legit users do not login. GP starts and does an auto-login pre-windows login. The logs tell me these failures are coming from