Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Resolved! Export and Import excluded alert Cortex XDR

Hi,

I wonder if there is a method to export the excluded alert from a Cortex XDR tenant and import this exported excluded alert into another Cortex tenant.

If I export the alert from the console filtering the alerts excluded=yes, I can download a .ts

...

Action #352 failed. Action description: Retrieve endpoint data from

Hi everyone,

I received the following notification, and I wanted to understand what this means?

Thank you

Shmuel

Action #352 failed. Action description: Retrieve endpoint data from

cannot install cortex on server core 2022

Hi all

i try to install cortex agent 7.8 on server core 2022 but it fails with little explanation

did someone success on it ?

=== Verbose logging started: 21-10-22 10:56:37 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\Wind

...

Blocking executions of IOC without showing any alerts

Hello ,

Please help us with the process of blocking of IOC process coming from various campaigns in cortex XDR .

Regards,

Shashank

Resolved! Automatically changing the status of incidents

Hello,

Cortex XDR is changing the status of incidents from Resolved to Under Investigation automatically. Why is this happening?

Named pipe hunting -Cortex XDR Pro

Hello dear community!

Is there a way to hunt for named pipe communication?

Rob

https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575

How to query for Vulnerability Assessment Data

I would like to query XDR externally for the data stored in the Host Insights > Vulnerability Assessment page.

I looked through all of the available APIs, but none of them seem to have data related to CVEs. I would not be opposed to writing a custom

...

Community Expert Verified

Resolved! Application Whitelisting (like Applocker, WDAC/MDAC, Airlock Digital) with Cortex XDR Pro?

Hello dear communinty,

we would like to know, if there will be a functionality in the future like applocker or MDAC for whitelisting applications/scripts/etc.. If they are not in out WL, they cannot be executed and we get a information/alert.

...

Resolved! Filter incidents on action in Cortex XDR

Hello,

I would like to filter incidents on what kind of actions have been taken. Is this available or should I make a feature request somehow?

Ie. filter on all incidents containing alerts that have prevented as action. Or Filter out any where the

...

Resolved! Cortex XQL incident query

Hello PAN community !!

I'm new in this platform and I am a little lost here. I'm trying to create a query to list all endpoints of a specific endpoint group with all its incidents (malware,etc).

To get the endpointgroup and its endpoints I'm using

datas

...

Cortex XDR: False Positive detection of VulnDetect scripts

Hi,

A number of our customers has complained about our signed PowerShell scripts being flagged and, in some cases, blocked by Cortex XDR.

The scripts in question can be found here:

https://stream.vulndetect.com/e/task.ps1

https://stream.vulndetec

...

Resolved! Linux support for XDR

Hi,

Which Linux distributions does Cortex support?

Host Firewall

Hello Team,

We intend to enable the Host Firewall feature in the Cortex XDR. Please give us a brief overview of how this feature works.

Not able to set Proxy for Windows 2012 servers

Hello ,

We are unable to see few servers in our endpoint list. But the user confirmed it has cortex installed in it and is enabled also particularly For Windows 2012 servers we're not able to set the proxy and for some hosts last seen connected dat

...

Agents Intermittently Disappearing in Cortex XDR Then Shows Up

Hi,

Some Agents in Cortex DXR disappears then shows up after few days - no pattern at all

If my understanding is correct, if the Agents are disconnected or there's a connection lost, the Endpoint Status column will dictate it.

But the Agents in q

...

User

Likes Count

8 Likes

4 Likes

2 Likes

1 Likes

Cortex XDR Discussions

Discussions