XQL - Hunt for Possible Spring4Shell Vulnerable Application

Brief:

Spring4Shell Vulnerability Exists in the Spring Framework. Java based application are developed using this framework, we would not see direct installation of spring framework on the system but as part of a Java application. (At least what I hav

A large number of port scans

Hi guys! 

Recently, we often encounter incidents associated with a large number of port scans in Cortex XDR. We assume that this started after the last update. Does anyone else have something similar?

Thank you!

Cortex blocking hashes in allowed list

Hello ,

Just wondering why does cortex block hashes that are already part of allow list sometimes ?

Analytics BIOC Rule, Identity analytics

Hi all

I have a question regarding a certain alert: Multiple user accounts  deleted

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/multiple-user-accounts-were-deleted

1) Is

Cortex XDR Pro - Vulnerability Assessment Replaced KBs

Hey dear Cortex XDR Admins and Users, 

when a KB was not installed in march and replaced with another KB from april like here:

https://administrator.de/forum/windows-server-2012-r2-windows-updates-2627286719.html

Is the best way to exclude the CVE in

Incident creation not working good at the moment

Hello dear Cortex XDR Community, 

I tested today some incident creations. In summary I can say, from about 10 executions, 3 Incidents were created under severity high. 

Under severity critical none. 

This is my BIOC:

No of alerts

Exections when I execu

XQL - Hunting Renamed LOLBINs Process Execution

Reason for Query:

LOLBINs are used quite extensively in attacks, in some cases LOLBINs are renamed and then used to bypass behavior based detection rules. Hence, the query is built to hunt for renamed process execution eg; cmd.exe renamed to xyz.exe a

Cortex xdr agent not checking in after install

Hi all, I have a problem with the agent - I have one agent that is not communicating with the xdr server after installation. The host in question had it's agent uninstalled via the xdr server, and then re-installed by the IT team. However now the hos

Query Share: XDR/PAN-OS URL Category Stitched Correlation Alert

Wanted to share a useful XQL query we have setup as a correlation rule in case anyone else finds it beneficial. This query requires that you have PAN-OS firewall URL logs available within XDR datasets, for example being sent to Cortex Data Lake. The

Install Cortex XDR agent for Mac using shell script

Can we use a script or command line to install Cortex XDR agent for Mac? Please advise. 

Scan stuck on \\?\GLOBALROOT\Device\HardiskVolume3\System Volume Information\tracking.log

Hello, we are using Cortex in a Citrix PVS environment.

We installed the agent with the VDI flag on the master vDisk. When we try to generate a scan on the new version of the vDisk, it always stuck on this file: 

 \\?\GLOBALROOT\Device\HardiskVolume3\S

Support for Azure Stack HCI OS

Hi Community!

Can anyone tell me when PAN will support Cortex XDR Agent on Microsoft Azure Stack HCI Os,

that is based on Windows Server 2019/2022?

https://azure.microsoft.com/en-us/products/azure-stack/hci/#overview

OS is out now for 1,5 years and no

Determining WHO Resolved An Incident In Cortex XDR

I would like to determine how to view the identity of the user who resolved an incident in Cortex XDR. Presently the only artifact available is a "Resolved Timestamp". This however tells you WHEN an incident was resolved not WHO resolved it.

Is there