Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

How to make console accessible to domain user?

Hello!

I'm new around here and I have a question.

How to make Cortex XDR console to be accessible only to domain users?

So only users connected to the domain network can access the Cortex XDR Console.

It'd be very helpful if you provide related document

...

Cortex XDR has Blocked a Malicious Activity but No Program Listed

Attached images show the pop-up that is going around our network this morning. Unlike before where it would list the program Cortex blocks there is nothing there and is pointing at Microsoft for the cause.

Is this a false positive? A windows servic

...

Resolved! Cortex Blocks system services

Hello everyone,

the problem started a day ago, when Cortex XDR started to trigger the behavioral rule "other.malware_gen_task.105" on the service

"System", when executing the child processes "smss.exe", "registry" and "memorycompression". It started wi

...

Http logs collector example not working

Hi
hope this is the right place to ask this question
We were given a temp user to play around with the Cortex XDR and we are trying to insert some dummy data into it.

I am trying to insert data using an Http logs collector, following this guide
unfortuna

...

Analytics BIOC Rules - Causality Change - No. of alerts rising, but where to see who, why and what?

Hello Admins,

We use Analytics BIOC Rules. But where is the Causality Change? No of alerts rising, but where to see who, why and what?

Thank you!

Rob

Resolved! Differentiating mail from multi-tenant XDR

I am working with a multi-tenant XDR configuration and I would like to differentiate between the Alert Emails to ascertain from which tenant the Alert has been produced . For example: Tenant 1 and Tenant 2 (mssp). When I receive an email notification

...

How can Cortex XDR Pro find the origin process from a DNS request if the process not uses DnsQueryEx RPC Call

Hi Community,

Is somebody able to explain if Cortex XDR Pro is able to find the origin process if you have the DNS Query? A lot of windows internal process uses rpc calls to a svchhost.exe, which then makes the dns resolving, which is cortex xdr pro t

...

Servers unable to complete scan job within 24 hours

We have some servers in our environment that have a lot of files. The scans are scheduled for 2am Saturday mornings, but do not complete within 24 hours and the scan times out and is then cancelled.

What are the steps to remediate this.

Resolved! Cortex Change managing server

Hi Team,

I'm seeing the different tenant address in Cortex xdr agent console it is connecting to another management server,

Could someone please help me to replace the correct managing server name,

Because currently that agent is not reporting to Cort

...

XQL - Hunt for Kerberos Relay Up Activity

Just posting, if this is useful for someone who might be hunting for Kerberos Relay Up (Privilege Escalation on Windows System) Activity.

The purpose of this hunt is to look for suspicious logon on windows system using Kerberos Auth Package where the

...

Resolved! XDR agent not triggering alerts in the managements console while blocking

Hi, I have a rather peculiar issue(?) with one of my agents.

Said agent is working as intended, however it blocked a certain file form running under "Local Malware Analysis". which is fine, but I did not receive any alert nor incident in the manageme

...