Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Compatibility of Linux OS on Cortex XDR

Hello,

Can you please help us in knowing if Linux AIX, Solaris, and Power Linux compatible with Cortex XDR?

If yes what all versions of there is supported.

Resolved! Endpoint Remote Agent Update Failed (Good connection)

Hi community,

I had encountered a weird scenario where my endpoint failed in updating its agent when I triggered it from the XDR portal. It connects to BrokerVM for updates, as with the same as the rest which succeed.

Network check: I have update

...

xdr_data dataset only returns nulls

Any idea why this might be happening?

I am expecting to see data from my Cisco ASA firewalls, XDR Agents and hopefully some causality/actor information. I only get Nulls.

Alerts on Cortex XDR Console

Hello,

What is the importance of alerts in cortex XDR? Do we need to work on all the alerts, as we get overwhelmed by the number of alerts.

What is the best practice to fine-tune the alerts so that no important alerts are missed.Is there any document

...

Weekly Scans in XDR

Hello,

Can we know the drawbacks of performing weekly scans on all endpoints in XDR. Why is it not recommended to perform weekly scan on all endpoints?

First SSO access from an uncommon ASN by user

Hello everyone,

Recently we started getting these types of incidents in our SOC team for Cortex XDR.

It shows that the user connected with SSO using this ASN.

However, it says that the ASN 263461 is suspicious but we can't verify it with lookup tool.

Any

...

Resolved! Windows OS issues with Cortex XDR enabled

A technician is claiming that after downloading XDR 7.6.1, the Windows start menu is not working. If he disables XDR, it works again. If he enables XDR, it stops working again. Has anyone else seen or heard of similar issues?

Resolved! Installed Linux Servers not reflecting in Endpoint

Hello ,

There are a few Linux servers in which cortex XDR was deployed but it is not getting reflected in our endpoint.

Performed check-in using the below command for the servers:

root@ubuntu:~$ /opt/traps/bin/cytool checkin

and configured the pr

...

Resolved! Check in frequency cortex xdr agent

Hi all,

I was wondering - how do i govern the frequency of check in\heartbeats of my xdr agents?

Is it even possible?

Parsing out VLANS from netflow collection

In Cortex XDR I'm trying to figure out how to create a parsing rule that will allow me to drop anything from certain VLAN's prior to it ingesting. Trying to use the Collect and filter but can't seem to figure out how to exclude a VLAN without having

...

XQL Query to list top process causing issues

Dear All,

I would like to know how to build a query to troubleshoot issues on a host where I wanted to list the processes running on the host and also to identify which is causing the issue. I am writing the below query to find no details, please h

...

Resolved! Endpoint Console Events visibility on XDR Dashboard

Hi,

I need the events from the screenshot below to be visible from the Cortex XDR dashboard. Is there any XQL query that could showcase these events with the endpoints hostname?

Resolved! Server got rebooted due to Memory Dump issue

Hello,

One of the servers got rebooted due to a memory dump. The server user checked with the Hardware OEM Dell and they have analyzed the minidump file and said that issue seems to be caused by Driver: cyvrfsfd.sys. When checked found that this fi

...