This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4391 Views
  • 0 replies
  • 3 Likes

Resolved! Force XDR Agent

Hello, Please, how to force XDR Agent to capture all commands on CMD and PowerShell without GPO? For example, we can detect quser command, but we can't detect Set-Alias command. The problem is another vendor can detect any command line running in memory. Best regards.

Resolved! I want to block commands and special operations that require administrator privileges on Windows.

Hi Experts, As stated in the title, I want to block commands and special operations that require administrator privileges on Windows. Is this achievable? Please tell me the necessary configuration method to achieve this (I couldn't find it when I searched, but I'd appreciate any documentation or knowledge pages). Thank you.

woody249 by • L4 Transporter
  • 2556 Views
  • 2 replies
  • 0 Likes

Cortex XDR Blocking Intel process

Hello,We have noticed a reoccuring issue between our clients, that a intel process is being blocked.The main cause of it being blocked is IntelGraphicsSoftware.Service.exe with a path something like this - C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_25.40.1953.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGr...

Please update MITRE Techniques in BIOC module

Please update MITRE Techniques available in BIOC creation menu for Cortex XDR V3.16 Missing MITRE techniques in BIOC module: T1204.004 - User Execution: Malicious Copy and Paste - https://attack.mitre.org/techniques/T1204/004/ T1204.005 - User Execution: Malicious Library - https://attack.mitre.org/techniques/T1204/005/ I am sure these aren'...

D.Ogle by • L0 Member
  • 1139 Views
  • 0 replies
  • 0 Likes

XDR 4 - default playbooks error

Hi, someone have Cortex XDR 4? i my case, i've adopted some playbooks, and all playbooks have problems with configuration. Configuration using old json values (context values), for example:incident.id and correct is issue.id etc etc

tlmarques by • L4 Transporter
  • 452 Views
  • 0 replies
  • 0 Likes

Resolved! Broker VM shown disconnected

Hi, our Broker VM is shown disconnected on XDR console. The VM is up and running and I can connect to it via SSH. It can connect to the paloaltonetworks.com domain as I can see the traffic on firewall. Version is 25.0.44. Even the last seen is today, but the VM keeps shown disconnected. We have had similar problems with thin clients agents but t...

Denied URL - Broker VM

Hi team! Does anyone have or have had a situation where the applet local agent settings show "Denied url: URL_HERE"? Sometimes for short periods of time (around 5 -30 seconds) our broker VMs turn on in red the applet and we can see the message "Denied urls: ch-<xdr-tenant> .traps.paloaltonetworks.com " The URLs denied are different, ...

MarcoMJ by • L1 Bithead
  • 1799 Views
  • 3 replies
  • 0 Likes

Resolved! Rare Login Query Not Working

Hi team, I made a correlation query that looks for logins that haven't been seen on the servers in the last 7 days. This filters all successful login to endpoint type servers. preset = xdr_login_events | join type = inner (dataset=endpoints | fields endpoint_name, endpoint_type) as ep ep.endpoint_name contains agent_hostname | filter endpoint_t...

a2123k1 by • L1 Bithead
  • 2193 Views
  • 4 replies
  • 0 Likes

Hostfirewall Status Report

Hi Team, I am trying to fetch some report from Cortex XDR console. I would like to know how many endpoints has host firewall rule applied. How many endpoints still running with Windows firewall. Is there any script available to check.

Causality Chain

Hello,Can you please explain the difference between the causality chain of the 2 attached photos?What exactly are the executions?   

exeptions.png
issue.png

Resolved! Cortex XDR Windows 11 ARM64 Support?

Is there a plan or timeline for XDR being supported on Windows 11 with ARM64?I have a customer getting the error message "this version of Cortex XDR can be installed only on x64 architecture systems, please use the appropriate installation package."

pdysart by • L1 Bithead
  • 11684 Views
  • 16 replies
  • 1 Likes

Process injection into lsass

We received an alert indicating creation of a remote thread in the lsass process by the Cortex XDR agent (cyserver.exe). I noticed that during the same time period, there were a few other processes that got injected by the agent (e.g. explorer, svchost, wmiprvse, and other Palo executables). I am aware that it might inject a monitoring stub to p...

  • 2611 Posts
  • 98 Subscriptions
Top Solution Authors
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks