Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Securing old web server IIS6

Hello,

We are solving a case of an IIS6.1 vulnerability on an old Windows 2008 R2 SP1 system. Microsoft no longer has support for Windows update. The customer cannot migrate to the newer system yet.
Would Cortex XDR be able to secure IIS v6.1 web serv

...

Resolved! Correct resolve types for XDR Incidents

Hi All,

I tried to find this on PA Knowledge base but unsuccessful. Our team tries not to make exceptions/whitelisting unless absolutely needed. Therefore, I believe teaching Cortex XDR correctly on what is safe and what is not is crucial.

For examp

...

Resolved! Can we check via cortex XDR which are systems have any specific software installed

Can we check via cortex XDR which are systems have any specific software installed

Adding comments to permanent device exceptions

Hi all,

Is there any way to add comments to existing device exceptions? I haven’t found the option to do so.

Java Deserialization Protection

Hello,

I am looking to enable the "Java Deserialization Protection" in my exploit profile.

I see the default is to leave it disabled.

anyone else have this enabled?

any advise or experience working with this?

Getting Multiple alerts about file "TwitchClient.exe"

I'm getting multiple alerts about the file "TwitchClient.exe" which is under below path

C:\Program Files\WindowsApps\AdvancedMicroDevicesInc-2.AMDRadeonSoftware_10.21.10043.0_x64__0a9344xs7nr4m\radeonsoftware\twitch\TwitchClient.exe

Is this file is a

...

Cortex XDR - Whitelist services in properway

Hi All 
I'm new to Cortex XDR Hub and i'm trying to manage somes clients in the right way.

I got this situation:
There are some clients who had used IoBit - DriverBooster for the drivers installation on the machine.
A lot of services about this applicat

...

Resolved! macOS Network Filter limited to no more than one active network service on M1 Mac

Hi,

I'm an enduser of Cortex XDR. Recently my workstation was migrated from an Intel MacBook Pro to a M1. During the migration process, both workstations were on macOS Monterey 12.3.1.

I've discovered on the M1 that with the Cortex XDR network filter

...

Resolved! Query Network

Hello XDR Community!

when the network (see screenshot) will be depprecated, will it be possible to get all the informations under network connections?

I don't get the same results and not dst_host which would be very usefull.

Here is my Query:

Networ

...

Server Core

Is it possible to install Cortex on a Server 2019 core edition? There is no graphic interface but we'd like to have Cortex running on all our servers.

Thanks!

Resolved! Expired Certificate in Cortex XDR documentation

Hi,

Just wondering if there is any reason why we need to keep the expired certificate on system for Cortex XDR.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/get-started-with-cortex-xdr-prevent/set-up-endpoint-protectio

...

Resolved! Using XDR Host Insights and XQL to report of machines with specific software

Hello All

I would like to use host insights to provide a list of each machine with a specific software installed.

For example computer that have software containing 'docker'

I can go to host insights, Applications, filter to include 'docker' and see

...

Do Palo Alto plan to add endpoint DLP option to the Cortex XDR/Traps offering?

In many cases the firewall based DLP or Prisma Access cloud based DLP is good enough but in some cases like if the web site can't be decrypted or a local corporate site that does not go through the Prisma Access an endpoint DLP is great.

So I hav

...

Resolved! Penetration testing for publicity

Hello!

are we allowed as cortex xdr customers to penetrate the security suite through other researchers/analysts like TPSC https://thepcsecuritychannel.com/ ? They will also put a video on youtube.

Thanks

Rob

Threat Intelligence Feed (IP-Adresses)

Hello!

we have bought a DNS SEC product with a TI Feed (with bad IPs - about 900k).

How can we integrate this into Cortex XDR?

It is a textfile, which can be downloaded through a simple link.

IP1

IP2

...

We need a way to put this IP-Check somewhere on t

...

User

Count

User

Likes Count

2 Likes

1 Likes

Cortex XDR Discussions

Discussions

Welcome to the Cortex XDR Discussions!

Rules and Best Practices

Securing old web server IIS6

Resolved! Correct resolve types for XDR Incidents

Resolved! Can we check via cortex XDR which are systems have any specific software installed

Adding comments to permanent device exceptions

Java Deserialization Protection

Getting Multiple alerts about file "TwitchClient.exe"

Cortex XDR - Whitelist services in properway

Resolved! macOS Network Filter limited to no more than one active network service on M1 Mac

Resolved! Query Network

Server Core

Resolved! Expired Certificate in Cortex XDR documentation

Resolved! Using XDR Host Insights and XQL to report of machines with specific software

Do Palo Alto plan to add endpoint DLP option to the Cortex XDR/Traps offering?

Resolved! Penetration testing for publicity

Threat Intelligence Feed (IP-Adresses)

Palo Alto Cortex Broker Virtual Machine (Broker VM) security understanding

Rare Login Query Not Working

Help with fine tuning a query using $arguments and enclosing them in "quotes"

Details regarding %PROGRAMDATA%\Cyvera\ folders

How to check powershell version at cortex XDR

[Cortex XDR] Are there any How-To video recordered about Windows Event Collector applet for the broker VM?

Cortex Broker Mapper scans

Re: Cortex XDR 8.2+ Not Able to Uninstall - Not Showing In Programs (Windows)

Re: Cortex XDR Get Incident API function 'hosts':None

Re: Rare Login Query Not Working

Unlock your full community experience!

Cortex XDR Discussions

Rules and Best Practices

Resolved! Correct resolve types for XDR Incidents

Resolved! Can we check via cortex XDR which are systems have any specific software installed

Resolved! macOS Network Filter limited to no more than one active network service on M1 Mac

Resolved! Query Network

Resolved! Expired Certificate in Cortex XDR documentation

Resolved! Using XDR Host Insights and XQL to report of machines with specific software

Resolved! Penetration testing for publicity