Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Network Location Files in Restrictions Profile

Hello Team, Could you please provide the benefits of Network Location Files in restriction profile.

Resolved! Yara Rules and Cortex XDR

I have seen alerts screenshot on internet where an alert triggered after matching a Yara rules. https://attackevals.mitre-engenuity.org/enterprise/participants/paloaltonetworks?adversary=carbanak-fin7&view=results&scenario=1(Fourth Screenshot) Does Cortex XDR uses Yara Rules? I mean the screenshot answers it but how? Do we need to upgrad...

Resolved! XDR Installation on Azure

Hi All, Can XDR be installed on VM deployed via Azure marketplace images? Thanks

Resolved! XQL Command Line Help

All, Trying to write a XQL query to search for this Windows command line when executed. Can anyone tell me how to distinguish the command line parameters "domain computers" in XQL? Thanks. actor_process_command_line = "%systemroot%\system32\net.exe group "domain computers" /domain"

Resolved! Cortex XDR malware scan

Hello , Does anyone know the difference between the Malware scan initiated from console and Scan initiated by user locally for all drive? Does cortex XDR also scans the memory and registries in the full scan initiated? and how long it should take a system or agent to timeout the scan it it continues in progress for long time. Cortex XDR

EvilExtractor

We have concerns about the Evil Extractor malware posted here: https://www.fortinet.com/blog/threat-research/evil-extractor-all-in-one-stealerI have not been able to find anything on the PA Cortex or Firewall Pages and need to get information back to my CIO that we are protected by PA on this. Thank you for a prompt response.

Resolved! Reporting in Cortex XDR Pro on more pages

Hello dear community, my supervisor needs a monthly report about still vulnerable agents. I got allready an XQL, which I used for the dashboard. config timeframe between "-1y" and "+5d" |dataset = host_inventory| arrayexpand kbs| alter kbnr = json_extract(kbs , "$.name"), install_date = json_extract(kbs , "$.installation_date")| fields ho...

Hunting for Keywords - How to do that in Cortex xdr Pro?

Hello dear community, how could this keywords be integrated into cortex xdr pro? https://mthcht.github.io/ThreatHunting-Keywords/ happy hunting! BR Rob

Cortex XDR | Azure AD Single Sign On Unauthorized. Error 4011

Hello all, I am trying to setup SSO on my XDR tenant but I am getting the following message when login inUnauthorized. Error 4011 In the console, the status is 401 Unauthorized I followed this video https://www.youtube.com/watch?v=nwF3hY3wgc0 The test user I created for this purpose should have the right access and in the right group, I d...

Resolved! WMIC MDE exclusions

Hello dear community, do we need to setup our own bioc, or will this come as a standard rule from PA? https://twitter.com/malmoeb/status/1671453836605550592 BR Rob

Resolved! Server certificate for host is not allowed

hi, I have this message on more windows server 2019(vmware environnement), after install cortex 7.1: Server certificate for host is not allowed: error=19, message=self signed certificate in certificate chainHTTP request failed due to an SSL error (0): SSL Exception: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify faile...

broker vm showing disconnected in xdr console

why brokervm showing disconnected in xdr console how to do get to know what had happen and how get in connected state.

Resolved! install cortex aarch64

Hello, we wonder if we can install cortex aarch64 on a raspbian. Does anyone try that? Thanks

Resolved! Cortex XDR Pro on Linux Mint

I am having an issue with an installation of XDR on Linux Mint 20. I found this post with no resolution and one of the comments from @MartinSauer suggests someone else was seeing the same issue.LIVEcommunity - ERROR:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE: certificate verify failed - LIVEcommunity - 317055 (paloaltonetworks.com) In...

Resolved! What are the capabilities of Cortex XDR without endpoint agents which ingest Logs and data From third EDR like MDE ?

Hello, I'd like to hear from people who have worked with Cortex XDR without the Cortex XDR agent. The scenario is as follows:The machines (workstations and servers) are protected by a third-party EDR solution (e.g. Micrsoft Defender for Endpoint).we'd like to add the XDR layer for greater visibility. So what are the capabilities of Cortex ...

Discussions

Welcome to the Cortex XDR Discussions!