This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4356 Views
  • 0 replies
  • 3 Likes

Resolved! Cortex XDR Windows 11 ARM64 Support?

Is there a plan or timeline for XDR being supported on Windows 11 with ARM64?I have a customer getting the error message "this version of Cortex XDR can be installed only on x64 architecture systems, please use the appropriate installation package."

pdysart by • L1 Bithead
  • 11275 Views
  • 16 replies
  • 1 Likes

Process injection into lsass

We received an alert indicating creation of a remote thread in the lsass process by the Cortex XDR agent (cyserver.exe). I noticed that during the same time period, there were a few other processes that got injected by the agent (e.g. explorer, svchost, wmiprvse, and other Palo executables). I am aware that it might inject a monitoring stub to p...

Resolved! Blocking PowerShell While Allowing Certain Powershell Scripts

Hi, good day! I need some help with configuring PowerShell restrictions in Cortex XDR. I'm currently facing an issue where Cortex XDR has detected a PowerShell script executed from a user endpoint. After investigation, we confirmed that this script is part of a legitimate IT department operation. Our goal is to allow specific, authorized Power...

How to delete Endpoints that have old agent and could not be uninstalled

Hello, I have 2 endpoints with old version: - 7.3.0.16740 on a server - 8.6.0.3704 on a computer I could not upgrade them and have no more access to those computers (in another country). I asked admin to uninstall, he did not. How to remove link between Agent and Cortex XDR server to recover the licenses. Thank you in advance for any help

S.MASSON by • L0 Member
  • 974 Views
  • 3 replies
  • 0 Likes

Cortex Endpoint Isolation - Allowing Microsoft Intune

Anyone have tips on figuring out how to allow exceptions to successfully communication over the internet while an endpoint is in isolation? I would like Microsoft Intune to be able to continue to reach the device while the device is in isolation for the purpose of lock-down policy enforcement and location tracking. While I understand the isolati...

Parsing Rule - SonicWall NGFW

Your mileage may vary. Here's what I came up with [COLLECT:vendor="SonicWall", product="NGFW", target_brokers=*, no_hit=keep] alter raw_timestamp = arrayindex(regextract(_raw_log, "time=\"([^\"]+)\""), 0), device = arrayindex(regextract(_raw_log, "id=(\w+)\s"), 0), serial_number = arrayindex(regextract(_raw_log, "sn=([A-Z0-9]+...

Resolved! Evasion Technique - 1244315488

Hi, We are getting a few alerts for "Evasion Technique - 1244315488" - "Evasion technique using reflective loading." While investigating I can see that a base64 encoded PE file is written in the registry by taskhosw.exe under "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UCPD\DR\000" -The registry key is not super well documented (UserCh...

Cortex XDR - Automation Rules

Greetings,Im trying to configure "Automation Rules" to "High" severity issues for the automatic isolation of endpoints. Right now its configured as the following images show, but theyre not triggering the playbooks nor rules. ¿Any ideas or suggestions on why its not triggering?

LAguero_0-1761831187524.png
LAguero_1-1761831211623.png
LAguero_2-1761831227232.png
LAguero_3-1761831271872.png
L.Aguero by • L0 Member
  • 1138 Views
  • 3 replies
  • 0 Likes

high priority 'Behavioral Threat' alert for smss.exe (system)?

Every few weeks or so getting a high priority alert: 'Behavioral Threat' generated by XDR Agent detected on host <some_WS2019_server> involving user system Priority: High Behavioral Threat Source: XDR Agent Behavioral threat detected (rule: sync.vulnerable_driver_by_original_name_loaded_procexp) User name SYSTEM Action ...

kindzma_0-1728399273223.png
kindzma by • L2 Linker
  • 4064 Views
  • 4 replies
  • 1 Likes

xql query for process

Hi. i just try to do some basic threat hunting. dataset = xdr_data| filter action_process_image_name in ("a.exe", "b.exe")| fields agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line , _time| sort desc _time so i try to identfied two different process is happening at same endpoints. how to do...

T.Nurmi by • L2 Linker
  • 1201 Views
  • 1 replies
  • 0 Likes
  • 2599 Posts
  • 98 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks