Cortex XDR Discussions

Resolved! Query Network

Hello XDR Community!

when the network (see screenshot) will be depprecated, will it be possible to get all the informations under network connections?

I don't get the same results and not dst_host which would be very usefull.

Here is my Query:

Networ

...

Server Core

Is it possible to install Cortex on a Server 2019 core edition? There is no graphic interface but we'd like to have Cortex running on all our servers.

Thanks!

Resolved! Expired Certificate in Cortex XDR documentation

Hi,

Just wondering if there is any reason why we need to keep the expired certificate on system for Cortex XDR.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/get-started-with-cortex-xdr-prevent/set-up-endpoint-protectio

...

Resolved! Using XDR Host Insights and XQL to report of machines with specific software

Hello All

I would like to use host insights to provide a list of each machine with a specific software installed.

For example computer that have software containing 'docker'

I can go to host insights, Applications, filter to include 'docker' and see

...

Do Palo Alto plan to add endpoint DLP option to the Cortex XDR/Traps offering?

In many cases the firewall based DLP or Prisma Access cloud based DLP is good enough but in some cases like if the web site can't be decrypted or a local corporate site that does not go through the Prisma Access an endpoint DLP is great.

So I hav

...

Resolved! Penetration testing for publicity

Hello!

are we allowed as cortex xdr customers to penetrate the security suite through other researchers/analysts like TPSC https://thepcsecuritychannel.com/ ? They will also put a video on youtube.

Thanks

BR

Rob

Threat Intelligence Feed (IP-Adresses)

Hello!

we have bought a DNS SEC product with a TI Feed (with bad IPs - about 900k).

How can we integrate this into Cortex XDR?

It is a textfile, which can be downloaded through a simple link.

IP1

IP2

...

We need a way to put this IP-Check somewhere on t

...

Can recognize Signer but not signature

I have a security event, I clicked in and found that the CGO signature is unsigned, but when I create an alert exception, it recognizes the signer, why is that? The signature is not recognized, but the signer can be recognized

Blocking Bluetooth Device in XDR???

Hello,

Seems XDR - Device control only block USB-related devices on the Endpoint, is it blocking any new Bluetooth devices if the GUID is unknown?

any ideas?

Cortex XDR

Resolved! Test alerts in Cortex xdr

Is there a built-in way to generate a test alert either from an agent installed on a client machine or through the XDR portal itself?

I currently have an agent ver 7.6.2 installed on a windows box and I'd like to create a test alert that will be visi

...

Resolved! Admin password changes

I received an email yesterday saying the passwords for admin accounts will need to be updated before April14th.

I just wanted to confirm that only admin passwords are being changed. Will there be any changes to integration API keys?

Cortex xdr did not detect malware, what good is it?

Cortex XDR did not detect malware, what good is it?

I got this scan with mal warebytes. 41 detected.

Resolved! Best Simulated (Fake) Malware To Use With Cortex XDR

Hi all,

Do you all know what the best simulated malware is to use in testing out rules/responsiveness/etc on Cortex XDR and where to download these fake malware from. Ideally it'll be benign specially constructed so they trigger same alerts as actual

...

Cortex Subscription license doubt

We have deployed more than 800 agents in the network. Currently, we have a trial license but they will purchase the license the next month.

If the actual license will come did we have to again reinstall the agents.

C:\ProgramData\Cyvera\Prevention folder piling up after installing cortex XDR

Hi Team,

After installing cortex XDR, I can see C:\ProgramData\Cyvera\Prevention folder is getting filled up fast in one of the servers. There are a lot of activities on this server and Traps is catching some malicious activities often. This will def

...

Discussions

Resolved! Query Network

Server Core

Resolved! Expired Certificate in Cortex XDR documentation

Resolved! Using XDR Host Insights and XQL to report of machines with specific software

Do Palo Alto plan to add endpoint DLP option to the Cortex XDR/Traps offering?

Resolved! Penetration testing for publicity

Threat Intelligence Feed (IP-Adresses)

Can recognize Signer but not signature

Blocking Bluetooth Device in XDR???

Resolved! Test alerts in Cortex xdr

Resolved! Admin password changes

Cortex xdr did not detect malware, what good is it?

Resolved! Best Simulated (Fake) Malware To Use With Cortex XDR

Cortex Subscription license doubt

C:\ProgramData\Cyvera\Prevention folder piling up after installing cortex XDR

Device connection alert

Use 2 datasets in the same XQL query

XDR Agent version naming convention

How to influence the XDR Analytics BIOC and the backend engine

Schedule Endpoint Script?

NGFW User-ID and Terminal Server (TS) Agent Self-Signed Certificates expiration

Re: Device connection alert

Re: Use 2 datasets in the same XQL query

Re: Use 2 datasets in the same XQL query

Re: XDR Shadow Copy use case

Unlock your full community experience!

Resolved! Query Network

Resolved! Expired Certificate in Cortex XDR documentation

Resolved! Using XDR Host Insights and XQL to report of machines with specific software

Resolved! Penetration testing for publicity

Resolved! Test alerts in Cortex xdr

Resolved! Admin password changes

Resolved! Best Simulated (Fake) Malware To Use With Cortex XDR