Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Resolved! Powershell Protected Script Block logging

Hello dear community, does Cortex XDR Pro handle also the protected event logging? https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.3#enabling-script-block-logging BR Rob

XDR service cyserver was stopped on ****

We were monitoring the XDR Agent Audit logs and found out a lot of agents have this alert Quota Exceeded: "XDR service cyserver was stopped on ****."Can anyone explain this, why this can happen?

Cortex XDR - method of installation

Hi All, I'm having a discussion with one of the PaloAlto support team members about an agent that is installed but disabled on one of our Windows endpoints. There are a number of endpoints with disabled agents out there but I opened a ticket for this one specifically because we want to get Palo's explanation of why it's disabled before we turn o...

Resolved! How to add a list of hashes to block list

Hello! Can I add a list of hashes to block list? Maybe from CSV? I have to add every hash manually? I have a list of 80 IOCs of a ransomware and I would like to add them to the block list at once. Is it possible? Thanks in advance.

BIOC detection for CVE-2023-2033

Hi community, I am attempting to create a BIOC detection for CVE-2023-2033. I can see via host insights there are some machines which are running versions vulnerable to this exploit, however I am looking to create a BIOC to trigger based on chrome being spawned with a version of 112.0.5615.121 or less. I can't seem to determine which que...

Resolved! A question from Cortex XDR Active Scanning Webinar: Malware scan

Is the 100MB limitation applicable to initiated Malware scans as well? *Note: This question was asked as part of the Cortex XDR Customer Success Webinar: Active ScanningWe encourage you to review the webinar article for additional resources.

Resolved! A question from Cortex XDR Active Scanning Webinar: Failed attempt alert

Is there an alert for a failed attempt/attempts to stop the Cortex Service on an Endpoint? *Note: This question was asked as part of the Cortex XDR Customer Success Webinar: Active ScanningWe encourage you to review the webinar article for additional resources.

Resolved! A question from Cortex XDR Active Scanning Webinar: Cortex agent scan

Would you consider initiating a Cortex agent scan on a new PC as a best practice? *Note: This question was asked as part of the Cortex XDR Customer Success Webinar: Active ScanningWe encourage you to review the webinar article for additional resources.

Cortex agent Upgradation

Hi Team, This is regarding Cortex agent upgradation, some of the endpoints having agent version (7.8.1.11342) agent life going to end this month. we tried to upgrade manually but it does not work. can cortex agent itself upgrade automatically without manually interception?

XDR Baseline document

Hello, Please help by providing XDR configuration baseline document. We require doument for review of XDR. Regards, Shashank

Vulnerability Assesment

Hello Team, 1. How frequently CVE's are added to the XDR Console?2. How PaloAlto addresses Patch Tuesday CVEs ?

Compatiblity Check2

Hello, Please confirm us if XDR can be installed on below BrokerVM servers. Hostname OS Version Application Name CORTEXXDRVM Ubuntu Linux (64-bit) XDR - Broker VM CORTEXXDRBROKER Ubuntu Linux (64-bit) CORTEX XDR BROKER

windows updating checking in cortex console.

Hi Team, On cortex console can we check what windows update installed on the endpoint?

Cortex XDR service getting stopped

why the Monitoring agent service getting stopped on multiples Hosts. When we checked the logs of some machines we got this error " XDR service cyserver was stopped on avd*** ". Could you please explain

High resource consumption

We have enabled cortx xdr in report mode and there is a constant high consumption of resources (CPU and Load Average) which causes problems in the machines. Does anyone know what feature usually consumes a lot of resources when enabled and causes the problem?

Discussions

Welcome to the Cortex XDR Discussions!

Resolved! Powershell Protected Script Block logging

XDR service cyserver was stopped on ****

Cortex XDR - method of installation

Resolved! How to add a list of hashes to block list

BIOC detection for CVE-2023-2033

Resolved! A question from Cortex XDR Active Scanning Webinar: Malware scan

Resolved! A question from Cortex XDR Active Scanning Webinar: Failed attempt alert

Resolved! A question from Cortex XDR Active Scanning Webinar: Cortex agent scan

Cortex agent Upgradation

XDR Baseline document

Vulnerability Assesment

Compatiblity Check2

windows updating checking in cortex console.

Cortex XDR service getting stopped

High resource consumption

Local Analysis Malware - Signed exe

bioc not prevent

Updating Cortex Agent by MDM

After more than 2 years Linux vulnerability reporting is still useless.

Cortex XDR Pro – Does it scan USB devices upon insertion?

Cortex XDR MITRE ATT&CK v16 -- We're Now on v19. Can We Talk About This?

Re: Suspicious executable detected Microsoft Store Purchase App

Re: Local Analysis Malware - Signed exe

Re: Local Analysis Malware - Signed exe

Re: Suspicious executable detected Microsoft Store Purchase App

Unlock your full community experience!

Resolved! Powershell Protected Script Block logging

Resolved! How to add a list of hashes to block list

Resolved! A question from Cortex XDR Active Scanning Webinar: Malware scan

Resolved! A question from Cortex XDR Active Scanning Webinar: Failed attempt alert

Resolved! A question from Cortex XDR Active Scanning Webinar: Cortex agent scan