Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Malware Scans on Linux Endpoints

Hi Team,

Can you please confirm we can run malware scans on linux servers and linux virtual appliances? We want to create a policy in XDR to run periodic malware scans on the servers (Specially linux servers and linux virtual appliances).

Regards,
Saks

...

The USB Read-Only policy causes the USB drive to fail to mount

I have set a USB Read-Only policy under Policy Management Extensions -> Policy Rules and Profiles. When a USB drive is inserted into an endpoint, Cortex XDR triggers a notification indicating that the USB is mounted as read-only, but in reality, it i

...

Cortex XDR blocks MalwareBytes

After a recent update to MalwareBytes Cortex XDR is now detecting and blocking it.

Has anyone else seen this, and is there a was to allow the MalwareBytes Digital Signature? I prefer not to have to allow the hash for each version.

Resolved! XQL query for all datasets

What's the fastest way to get a list of all data types by product and vendor across all data sets? I am looking for a way to query internal logs of XDR to get a list of all types of logs that are getting ingested into the XDR instead of using wildcar

...

Resolved! 7.9.1 to 7.9.2 fails with Azure Code Signing support missing error

Hi,

I have a few Windows 7 and Windows 2008 R2 machines, cannot upgarde Cortex XDR from 7.9.1 to 7.9.2, error message says I am missing Azure Code Signing support and to see KB5022661.

No luck googling, hopefully somebody has a tip for me.

XQL/BIOC - web

Hello,

Can you tell me in which dataset I can find the following data?

URL addresses
User Agent

With this information, can we create a rule that is based on defined values and then generate an alert based on it or block it within the Restriction

...

Cannot update user role to another user

This is about user permssion settings, I'm already the account admin of the XDR tenant already.
Currently, the user scope is set to all, i want to change the scope for specific user.
But there is no update user permission when right click on user
does

...

XQL Timeseries Chart

I'm trying to build a timeseries chart that counts alert volume per day and that fills in zero values for days with no data. I have the following XQL that populates days with data but I'm unable to fill in a zero for all other days between now and th

...

Resolved! Blocking PowerShell While Allowing Certain Powershell Scripts

Hi, good day!

I need some help with configuring PowerShell restrictions in Cortex XDR.

I'm currently facing an issue where Cortex XDR has detected a PowerShell script executed from a user endpoint. After investigation, we confirmed that this script

...

how to check PAN OS version running in the firewall in cortex XDR

XDR Agent - retrieve more information events

Hi,

I have a question. I'm seeing XDR events with "Memory Corruption Exploit" generated by the XDR Agent... Cortex XDR

I know this typically happens when users open a DOCX file with macros. My question is: Is there a way to collect information rel

...

Resolved! [Mac & Linux ] Quarantined Files location

Hi, do you know the default location for the Quarantined Files location for Mac and Linux ?

i know the local quarantine folder for Win is (%PROGRAMDATA%\Cyvera\Quarantine ,but what about Mac and Linux ?

Cortex XDR

Broker VM - Local Agent Settings Applet Error

Hi Team,

As observed, we're getting the below error in the local agent settings applet in our broker vm's. We have three broker vm's in place and all of them are showing the same error. We have not made any changes in the configurations. Could you ple

...