This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4319 Views
  • 0 replies
  • 3 Likes

Tracking Cortex XDR Corrupted Agents

Dear Community, When I first started the Cortex XDR Project and started installing the agents, I made a mistake and deleted the outdated installation packages from the portal. After that I started getting a lot of disconnected agents as if they try to connect to the portal and the ID is already deleted. Since it will be hard to know which asse...

AmmarJi by • L1 Bithead
  • 2696 Views
  • 4 replies
  • 0 Likes

Resolved! Details Regarding XDR Query Fields: server_creation_time and creation_time

Hello Everyone, We use below endpoint to collect the alerts: /public_api/v1/alerts/get_alerts Currently, we use creation_time to query alerts. But recently with the help of community answers only we found that creation_time is the time when an alert was created on the endpoint and not the time when the alert was ingested in XDR. For real ti...

Allow users to change the Timezone

Hello, We have users from different places and different timezone. We noticed that it is not possible for a user to change their timezone if they don't have the General Configuration View/edit permission. Is there any other way to allow a user to change their timezone in XDR? Thank you all!

atayar by • L0 Member
  • 2811 Views
  • 2 replies
  • 0 Likes

Resolved! Users may experience account lockouts due to XDR services.

Dear Community, After modifying the password for a Windows user, the user account is continually locked out.Using Process Monitor, it was discovered that the XDR service (cyserver.exe) read cached credentials(C:\ProgramData\Cyvera\LocalSystem\Python\payload\grpc\_cython\_credentials).At approximately the same time, the lsass.exe process began se...

Chilla by • L1 Bithead
  • 3016 Views
  • 1 replies
  • 0 Likes

Resolved! Can't find logged in users from Endpoint Asset View

Hello all, I find it strange that I cannot easily check the connected or previously logged in users on an endpoint. For example on Asset View or from Endpoints view I cannot see that.There is the possibility to see it only on an incident I guess. But only then.Do I miss something? Thanks

Panagiss by • L1 Bithead
  • 2170 Views
  • 1 replies
  • 0 Likes

Host Insights - Functionality limitation through license

Hello dear community, we had not enough host insights licenses. About 13 agents are not available in the module system information. Where is the trigger to say one or more of them should now gather or send the informations to Host Insights? This topic is about one week ago, since we have the new license. BR Rob

RFeyertag by • L4 Transporter
  • 2524 Views
  • 4 replies
  • 0 Likes

Resolved! Detail Description of Alert Log Fields XDR API

Hello Everyone, We are pulling alerts from the XDR API using below endpoint: /public_api/v1/alerts/get_alerts We query based on creation time which is shown as detection_timestamp in the log. I am looking for clarity on below points: 1. what is local_insert_ts field? What is the significance of this field? How it is different from creat...

Resolved! Requesting Clarity on XDR XQL API Logging

Hello Everyone, For one of the client, we need to fetch logs from XDR API using XQL. Currently, the ask is for windows event logs only, but later they want IIS logs as well. Any help in below queries would be appreciated: 1. There are two queries by which I fetched logs successfully. One is using: dataset= xdr_data | filter event_type = EV...

Cortex XDR 3.6 How to remove several profiles at once

Hello Everyone, Do you know if XDR supports option for removing several profiles for the console at the same time. There is an option for manual removal profile y profile, but i have to make a clean up on environment with several hundred and some automation will be very useful ? Thank you in advance

Check Cortex XDR Agent status

Is it still possible to check the status of Cortex agent in registry? I want to check the status on the client side periodically. I know it is possible via cytool but i need to do this periodically on a lot of computers. I know there was a way on Traps agent via the registry. Is this still possible or are there any other ways?

Nazlikul by • L1 Bithead
  • 5039 Views
  • 4 replies
  • 0 Likes
  • 2582 Posts
  • 95 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks