Cortex XDR 7.4.1 in MAC having Malware Definition date as year 1970

Cortex XDR 7.4.1 in MAC having Malware Definition date as year 1970 in The Global Protect.

Somehow, the AV definition date for Cortex in Global Protect is showing as 1970. User is not able to connect to Global Protect as its failing HIP match from

What does it mean Prevented(Blocked) by the Agent XDR?

Hi all,

What does the Prevented (Blocked) action of the XDR agent mean? Does the user receive/see any notification?

And, how do I prevent the XDR agent from blocking that key artifact?

Thank you,

David. 

IOC Function

Hi Everyone,

Until now, I cant understood a function from IOC in Cortex XDR.

Could please share to me what's a main function IOC XDR?

Because I have tried to create new rules, for block link m.facebook , like a picture.

But, after that I have tried to

Cortex XDR block to execute Xcode Execution

In some of user cortex XDR agent blocking the Xcode simulator-trampoline program. Its detect as malware and Suspicious executable detected. when we show alert after some time wildfire score display Benign and low confidence so is it safe to allow tha

Custom Role: What is "Disable Response Actions"?

What does "Disable Response Actions" entail for a permission? I can't find a document that outlines the permissions. Can someone explain and/or point me in the direction of what each permission allows.

Can't automate the Cortex agent for Linux install due to the RPM issues

We are having issues with rolling out Cortex using automation tools. Since the RPM doesn't take care of figuring out dependencies by itself, you need to manually go install those dependencies and then install the RPM. This makes installs messy and, s

In-shell PowerShell commands not captured

As of at least 2020/07/10, I've only ever seen Cortex XDR capture PowerShell commands were included as parameters of a command-line process - never in-shell commands (opening PowerShell then manually executing the commands).

Enabling PowerShell modul

File reads not returned

The file event search is supposed to support reads but I've never seen it work.

Is this a known problem?

Examples:

View general forensic timeline for endpoint

Is it possible to view the forensic timeline for an endpoint in general, not only for information that the system thinks is relevant to a specific incident?

If not, can this be added?

XDR Prevent 7.2.0 Performance Issue on Win10 x64 v1903?

Has anyone upgraded to the 7.2.0 agent yet that has experienced performance issues?  Like most persons our environment is constantly changing, but at the suggestion of someone at Palo Alto I upgraded my system to the 7.2.0 release last Thursday for a

How to filter CIDR in XQL search

Hi, I'm trying to build XQL queries that target internal vs external IP ranges.

This is easy in the normal query builder with 10.0.0.0/8|172.16.0.0/12|192.168.0.0/16 but I'm not able to re-create this in XQL. 

Install a version 7.4.1 cortex XDR on a file server

Cortex XDR Tests