Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Cortex XDR - Blocked Hashes on newer systems do not show in Incidents

Hi,

As the name suggests we have blocked certain hashes on Cortex XDR. However when a some new system runs the blocked hash file(s), they do get blocked a prompt is also shown on the system but there is no incident on Cortex Incident tab. Why is it

...

XQL Incident Count Doesn’t Match UI Incident Count — Same Date Range

Hi everyone,

I’m working on a report using Cortex XQL to count incidents created between March 15 and March 31, 2025.

Here’s the query I’m using:

config timeframe between "2025-03-15 00:00:00" and "2025-03-31 23:59:59"
| dataset = incidents
| filte

...

Resolved! How to check powershell version at cortex XDR

Hi everyone,

I'm a beginner of Cortex XDR.

I need to confirm what devices have older versions of powershell installed and when I search for apps named powershell using host inventory I can only get 300+ results for powershell 7.

I changed some ke

...

Palo Alto Cortex IIS API Query

Hello Everyone,

We ingest IIS logs by querying Cortex using a custom-built sensor utility. Recently, we've started encountering a NullPointerException. Upon investigating in our test environment, we found that the issue is related to a field in th

...

Cortex XDR Linux Agnet version 8.7.0.131661

Hi Team,

We tried to install the XDR agent version 8.7.0.131661 on a Linux machine. The installation was successful, but the XDR services are all in a "stopped" status. We attempted to start all services using the command cytool runtime start all,

...

Resolved! Cortex XDR ARM Support still in Private Beta?

We have a lot of devices with ARM architecture and would like to start testing as soon as it's publicly available.

Any update on the timeline for general availability would be appreciated!

VSCode Very Slow with Cortex XDR installed

Hey all,

We deployed Cortex XDR a few months ago and since then our developers have been very frustrated with the performance of VSCode.

When VSCode is launched the Cortex XDR Service on the system spikes heavily with CPU usage, and VSCode takes

...

Check Point Threat Emulation (SandBlast) integration with cortex

Hi everyone, i need help to solve this issue. Could you help me?

I accidentally installed Cortex XDR on a personal computer and I don't have uninstall credentials.

I accidentally installed Cortex XDR on my personal computer, and now I cannot uninstall it because I do not have the uninstall password or access token. I am not part of any organization and this is a personal PC. What should I do?

Child(?) Broker VM Setup

We are a semi-isolated environment with no internet connectivity, and have a customer requirement of having minimal network traffic between our environment and one with internet connectivity.

We are looking at implementing Cortex XDR on our environ

...

cortex xdr custom xql query to view server operational status

hi,

Most of the customer who uses paloalto cortex xdr want to visualize the server operational status in a dashboard in that case use below query as follows,

"dataset = endpoints | filter operating_system contains "windows server" or operating_syst

...

The compliance violation dashboard is empty.

Good morning, team,

I wanted to ask a technical question. We currently have five Linux hosts in our tenant, but when I log into the dashboard to see the compliance violations for these hosts, I don't see any information.

To see the compliance viola

...

Resolved! Cortex VM Broker SNMP monitoring

Hello guys,

i would like to know if it's possible pour monitoring the VM broker with snmp protocol ?

i need to add this VM to my PRTG server, but i can't do it !

Best regards,

Grégory

Dashboard refresh time

Hi,

I have noticed that Cortex XDR is not refreshing dashboards on its own and it requires to press the refresh button. Is it possible to set the refresh time somewhere in the configuration settings?

How to Filter Incidents by Creation Time in XQL Within a Specific Timeframe?

I need to write an XQL query for a fortnightly report. The query I currently use is shown below, but it's incorrect for my purpose:

config timeframe between "2025-03-01 00:00:00 +0000" and "2025-03-15 23:59:59 +0000" 
| dataset = incidents 
| filter

...

User

Likes Count

8 Likes

4 Likes

2 Likes

1 Likes

Cortex XDR Discussions

Discussions

Welcome to the Cortex XDR Discussions!

Rules and Best Practices

Cortex XDR - Blocked Hashes on newer systems do not show in Incidents

XQL Incident Count Doesn’t Match UI Incident Count — Same Date Range

Resolved! How to check powershell version at cortex XDR

Palo Alto Cortex IIS API Query

Cortex XDR Linux Agnet version 8.7.0.131661

Resolved! Cortex XDR ARM Support still in Private Beta?

VSCode Very Slow with Cortex XDR installed

Check Point Threat Emulation (SandBlast) integration with cortex

I accidentally installed Cortex XDR on a personal computer and I don't have uninstall credentials.

Child(?) Broker VM Setup

cortex xdr custom xql query to view server operational status

The compliance violation dashboard is empty.

Resolved! Cortex VM Broker SNMP monitoring

Dashboard refresh time

How to Filter Incidents by Creation Time in XQL Within a Specific Timeframe?

Details regarding %PROGRAMDATA%\Cyvera\ folders

How to check powershell version at cortex XDR

Cortex VM Broker SNMP monitoring

Cortex XDR along with Defender for endpoint Compatibility

XQL Widget to Exclude Weekends

Re: Cortex XDR XQL query to get list of all vulnerabilities

Re: How to check powershell version at cortex XDR

Re: Cortex VM Broker SNMP monitoring

Re: Cortex XDR ARM Support still in Private Beta?

The compliance violation dashboard is empty.

Unlock your full community experience!

Cortex XDR Discussions

Rules and Best Practices

Resolved! How to check powershell version at cortex XDR

Resolved! Cortex XDR ARM Support still in Private Beta?

Resolved! Cortex VM Broker SNMP monitoring