Please share your useful XQL queries!

Hello!

as a beginner with Cortex XDR I asked me, what are interests of others in the query section. 

If you have some interesting and useful queries, please share and describe them in a short way. 

Thank you!

BR

Rob

False Positive: Suspicious File Modification' generated by XDR Agent - Module Anti-Ransomware Protection

Hi we see a problem with a powershell Script we are using to clean up Profiles on some specific Remote Session Host Servers.

It will be blocked by Cortex XDR Pro and so I want to make an Exception for this.

Unfortunately it seems only possible to do a

How many attempts constitute a brute force attempt?

Occasionally, I see an alert with the description of "LDAP: User Login Brute Force Attempt".  If I'm reading the tea leaves correctly, we're relatively confident that we're observing a failed logon for someone performing maintenance on a specific dev

Cortex XDR Agent Driver Shutdown on Windows 11 22H2

Hello Team,

We have received an advisory for Cortex XDR Agent Driver Shutdown on Windows 11 22H2. Its was recommended that to pause any planned upgrades on endpoints running the operating system Windows 11 22H2. 

It was also mentioned that a new

Compatible Check

Hello Team,

Can you confirm whether the Broker VM appliance compatible with cortex XDR.

how to suppress the prompt "Cortex XDR" would like filter network content"

for the Macs, how does one configure Cortex to suppress the display of this prompt (see attached), and just automatically use 'Allow'.

Ive tried calling up com.paloaltonetworks.cortex.app.plist, but I don't see an obvious key pair where this behavi

To find the hashes of the applications through XQL search

Hi team,

is there a query to get the hashes of the applications installed in host inventories or any other way ?

Wildfire Test File

Has anyone had issues with the Wildfire Test file not showing up as an alert in the cloud? On the workstation it's getting blocked just fine. I haven't had a regular alert fire in about 2 months. Just wondering if I have an underlying communication i

Limitations Cortex XDR Pro with Threat Intelligence Feeds

Hello dear community, 

I'd like to know more about how you fill your IOCs in Cortex XDR Pro. 

There are so many TI Feeds outside:

https://www.comparitech.com/net-admin/best-threat-intelligence-feeds/

I'd would prefer the low cost variant (XDR P

Cannot Install XDR Agent Because ./setup.sh Permission Failed

I tried to install XDR Agent on my Redhat VM. After I changed my installer file permission and run the script, it said ./setup.sh: Permission denied.

i already checked my file permission and theres nothing wrong with it.Is there someone have the same

Does cortex XDR use Apache HTTPD 2.2.15 for communication

Hello Team,

Does anyone has idea about the protocols that cortex XDR used for communication.

Does Cortex XDR uses Apache HTTPD for communication?

Cortex XDR