In-shell PowerShell commands not captured

As of at least 2020/07/10, I've only ever seen Cortex XDR capture PowerShell commands were included as parameters of a command-line process - never in-shell commands (opening PowerShell then manually executing the commands).

Enabling PowerShell modul

File reads not returned

The file event search is supposed to support reads but I've never seen it work.

Is this a known problem?

Examples:

View general forensic timeline for endpoint

Is it possible to view the forensic timeline for an endpoint in general, not only for information that the system thinks is relevant to a specific incident?

If not, can this be added?

XDR Prevent 7.2.0 Performance Issue on Win10 x64 v1903?

Has anyone upgraded to the 7.2.0 agent yet that has experienced performance issues?  Like most persons our environment is constantly changing, but at the suggestion of someone at Palo Alto I upgraded my system to the 7.2.0 release last Thursday for a

How to filter CIDR in XQL search

Hi, I'm trying to build XQL queries that target internal vs external IP ranges.

This is easy in the normal query builder with 10.0.0.0/8|172.16.0.0/12|192.168.0.0/16 but I'm not able to re-create this in XQL. 

Install a version 7.4.1 cortex XDR on a file server

Cortex XDR Tests

high memory use (700M)

agent 7.4.0

high memory use-738M

I take log support and uninstall the program, it's happening only on one computer.

what should I check on the support log? there is so many file and log...

alert question-Agent Uninstalled

I receive alerts from my siem, that the XDR sent alert agent uninstalled

and the computer name is it1179128192

I asked our help desk and they say that we don't have a computer with this name.

Where can I found information about this activity I want t

in XDR.. what are the steps if we need to create the group based on subnet

Hello,

Need help how to create groups in XDR based on the network subnets 

'HTTP/2 500 server' Error while requesting XQL query result over API

hi there, 

I'm quite new to cortex, gone through the guide available on the site but nothing related to the following error:

HTTP/2 500 server: openresty/1.15.8.2 date: Sun, 18 Jul 2021 05:26:48 GMT content-type: application/json content-length: 131

Accidently deleted endpoints in Cortex console

Hi All,

I have accidently deleted endpoints in cortex console. Can you please advise how to get back those deleted.

Regard 

Asif Siddiqui