Ignore all authentication requests alerts from a particular IP

We use a vulnerability scanner internally to test all endpoints for any known vulnerabilities or leaked credentials.

Cortex has been alerting to this, but since we know this is intentional traffic, is there a way to ignore certain authentication requ

Live Terminal over Broker VM

Hello everybody.

I want to know if we can initiate a live terminal session over Broker VM ( our agents dont have internet access so they use Broker VM ). 

1) In documentation Palo Alto say that network requirements for Broker VM are these:

     - br-<X

Memory Corruption Exploit Alerts - Incidents

Hello LiveCommunity, I wondered if any others are seeing a very high number of recently created (in the last few hours) "Memory Corruption Exploit" alerts in Cortex XDR?

Beginning around 1015 Pacific this morning (11 Oct) thru as recent at 1518 Pacifi

XDR Cloud Identity Engine and proxy

Hello everybody,

We want to integrate our Active Directory to Cortex XDR via Cloud Identity Engine. But there must be proxy between Cloud Identity Engine and Cortex servers. We setup a lab environment for test purpose ( simply forwarded web traffic v

XDR vs XSOAR

Hello people ,

I am trying to figure out real difference between XDR and XSOAR.

XDR is far more intelligent than. SIEM . So this means SIEM is killed ?

XDR can also perform incident response , so what is the real value of SOAR?

XDR Client version 7.5.0 High Memory Usage

We recently upgraded our XDR Clients from 7.4.2 to 7.5.0. Since the upgrade a lot of our Windows Servers seem to be using a lot more memory that what I recall other client versions using. For example, older versions where like 200-400MB of usage but

Alert USB activity

Hi community,

Can I check is there any one create a alert if a user copied more than a certain number of files into a USB drive?

Thank You, Cheers!

remove users Cortex XDR

Hi,

I'm trying to remove user from "Access Management" in Cortex XDR but I cant find a way to do so.

What is the best way to preform this task?

Thanks on advance,

Ronnie.

Cortex XDR Uninstall without password and active tenant

On Windows computer we have installed the cortex XDR  agent on POC tenant.

The tenant was deleted but we don't uninstalled the agent on the client computer.

We try to uninstall it manually, but we don' have the password.

We try with the default password

Need to extract installed application.

Hi,

I have queries regarding cortex XDR,

Does the cortex xdr provide application inventory counts?

We want to extract each and every application which is installed in all our network systems but with IP.

for e.g, 10.10.10.10 is a system IP, I want to

Problem uninstalling Cortex XDR Agent

I often have the problem that the host loses connection to Cortex console due to a failed agent update and I cannot uninstall the agent on it and reinstalling the agent results in a rollback. There is a file named "tdevflt.sys" left in the "C:\Progra