Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Playbook to enrich dataset data into alert context

Hi, Is anyone able to guide me on how to achieve this perhaps? I want to ran a task in a playbook that will do a custom query in a dataset and pull information and add it to the alert context data.. is this possible and if so guidelines would be appreciated. thanks in adv

Cortex XDR – Unable to Assign Read/Write Permissions for Mobile Device (Detected as CD-ROM) in Permanent Exceptions

I am working on a Cortex XDR Device Control configuration and I need to allow a specific mobile device only for file transfer from the endpoint to the device, but I do not want to allow any data transfer from the mobile device back to the endpoint. However, I noticed that the device is detected as a CD-ROM device type in Cortex XDR (1.ss). When ...

Want to use Cortex XDR Agent Cleaner but cant log support as licenses expired

Hi all, My XDR portal has expired and i want to use/test the Cortex XDR Agent Cleaner as part of my role. Can i access this tool elsewhere, or can i use my support for my other Palo products to request this?

Install XDR agent for unmanaged PC in remote users

hello experts, we got users who is work from home. no IT support, looking for a way to install XDR agent for users. using teamview or anydesk?? any experience to share? Thanks SdG

Restrict traffic to public IP addresses with Cortex

I have dual homed systems with one of the IP addresses being publicly routable due to a cellular connection. My goal is to use Cortex to block traffic destined to those public IPs. An XQL query has been constructed to match traffic I would like to block, and I have created a BIOC that meets the intent as well, however I'm not seeing that BIOC as...

How to escape a wildcard (*)

How could you escape a wildcard in a query For example if i am looking for suspicious LDAP queries like (objectclass=*), i need that to be literal and not match on things like objectclass=example. I have tried many different combinations including just a simple \* but have not found anything that works

Resolved! Exclusion process cortex?!

Hi,How can I create an exclusion in Cortex XDR to stop it from scanning a specific executable?? We have a critical software in our company, and we've noticed that Cortex is constantly analyzing it, causing the machine high CPU and MEM.How can we exclude this file from the analysis? We want to maintain protections such as Ransomware, just excludi...

Resolved! Force XDR Agent

Hello, Please, how to force XDR Agent to capture all commands on CMD and PowerShell without GPO? For example, we can detect quser command, but we can't detect Set-Alias command. The problem is another vendor can detect any command line running in memory. Best regards.

Capture the running command in memory

Hello, Please, I want create XQL query or BIOC to show any running command in memory (fileless_scriptload_cmdline). Best regards.

Resolved! I want to block commands and special operations that require administrator privileges on Windows.

Hi Experts, As stated in the title, I want to block commands and special operations that require administrator privileges on Windows. Is this achievable? Please tell me the necessary configuration method to achieve this (I couldn't find it when I searched, but I'd appreciate any documentation or knowledge pages). Thank you.

Upgrade 4.X Cortex Tenant

Does anyone know how to upgrade the Cortex tenant from 3.x to 4.x, do I have to talk to Palo Alto or it can be upgraded by myself?

Cortex XDR Blocking Intel process

Hello,We have noticed a reoccuring issue between our clients, that a intel process is being blocked.The main cause of it being blocked is IntelGraphicsSoftware.Service.exe with a path something like this - C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_25.40.1953.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGr...

Please update MITRE Techniques in BIOC module

Please update MITRE Techniques available in BIOC creation menu for Cortex XDR V3.16 Missing MITRE techniques in BIOC module: T1204.004 - User Execution: Malicious Copy and Paste - https://attack.mitre.org/techniques/T1204/004/ T1204.005 - User Execution: Malicious Library - https://attack.mitre.org/techniques/T1204/005/ I am sure these aren'...

XDR 4 - default playbooks error

Hi, someone have Cortex XDR 4? i my case, i've adopted some playbooks, and all playbooks have problems with configuration. Configuration using old json values (context values), for example:incident.id and correct is issue.id etc etc

Resolved! Broker VM shown disconnected

Hi, our Broker VM is shown disconnected on XDR console. The VM is up and running and I can connect to it via SSH. It can connect to the paloaltonetworks.com domain as I can see the traffic on firewall. Version is 25.0.44. Even the last seen is today, but the VM keeps shown disconnected. We have had similar problems with thin clients agents but t...