Login details in Cortex XDR

Hello,

We are trying to create a quarantine policy for machines that are not connecting to the console, so we are checking if NAC solution can fetch these details and based on that policy can be created. And also, where (file path or file name) can w

rare iptable delete command

We received couple of alerts on rare iptable delete command.On checking the host activity, we could able to observe all commands including newly entered command in the host machine but not able to see the iptable delete/flush command in the activity

Integration between CDL and Rapid7 InsightIDR not working

I am working on the integration between CDL and R7 IDR SIEM and this is not working. I don't get pass the test connection on CDL. 

https://docs.rapid7.com/insightidr/palo-alto-cortex-data-lake/ 

https://docs.paloaltonetworks.com/cortex/cortex-dat

Log BrokerVM license has expired.

We receive an alert Management Audit Log: Broker VM XXXXXXXX license has expired - Deactivating applet XXXX.

I'm not sure about this log, someone please help suggest us.

Cortex XDR 

Execute a program in my endpoint from live terminal Cortex XDR

Hi everyone, 

has anyone tried to execute a program in an endpoint from live terminal? I mean, when you are in the endpoint you can use a command like c:\notepad.exe in cmd and it opens notepad, I want to do the same but from the live terminal, I t

Cortex XDR folder exclusion - for Mac-Clients

How do i put a Folder on a Mac-Client in the Malware-Policiy-Profile into the Allow-List?
For Windows-Clients, thats no big Problem, the Path always gets delivered with the Incident, but for Mac, the Path does not seem the Case, or, at least, i cannot

Active Scanning on Endpoints

Hello,

We intend to perform scheduled scanning on all endpoints. So we wondered if active scanning was required on all endpoints repeatedly, or if cortex developed its own scan whenever a new file was created or added to the system.

Cortex Filter on MacOS prevents internet connectivity

Hey everyone,

We're having some issues with the most recent Agent Version on MacOS (7.9.0.2505).

When some of our clients were upgraded to this version they suddenly lost internet connectivity. The only thing that worked for them was to remove Co

Mitre ATT&CK coverage

Hello dear Livecommunity, 

as you know, Cortex XDR is a very powerful peace of software and I am happy to use and administrate it. 

But I never doubt about coverage of the mitre attack patterns and I am a little bit upset, we need to get through th

Broker VM & SIEM

Hello folks.

How we can forward Cortex Agent logs from Broker VM to SIEM systems?

[agent] ====> [Broker VM] ====> [SIEM]

Cortex XDR