This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4402 Views
  • 0 replies
  • 3 Likes

Resolved! XDR Scan

Hello, 1. If we create a policy related to scanning of endpoints and apply that policy in all the machine and run it on all the machine at the same time. Is it this method possible? Will it create any issue?2. Pop up messages to users for malicious files during malware scans - Is this possible? If yes, is it documented? please share.3. What i...

Logs not visible - XQL Query

Hello, Currently we are trying to create a query that gives us the result if the user has executed Sudo command and then right after executed the cd command. Is it possible to write a query that searches for commands executed one after the other? During this process we observed that cortex is not giving us logs for cd command in any of the s...

Login details in Cortex XDR

Hello, We are trying to create a quarantine policy for machines that are not connecting to the console, so we are checking if NAC solution can fetch these details and based on that policy can be created. And also, where (file path or file name) can we find last-check-in details locally on the machine apart from the Agent console?

Resolved! Which one is better between cortex XDR host firewall and windows firewall ?

Hi All, Is it a good idea to enable the XDR host firewall to manage all endpoint communication? or is it better to keep the default windows firewall enabled without using the XDR firewall? I would be happier if someone suggests any article/documentation links which show a comparison between the XDR firewall and windows firewall in terms of f...

MithunKT by • L2 Linker
  • 9976 Views
  • 7 replies
  • 0 Likes

rare iptable delete command

We received couple of alerts on rare iptable delete command.On checking the host activity, we could able to observe all commands including newly entered command in the host machine but not able to see the iptable delete/flush command in the activity log under Query builder.

Muthuvel by • L0 Member
  • 1534 Views
  • 1 replies
  • 0 Likes

Resolved! Cortex XDR Broker VM handling

Hello dear live community! We are now at the step where we connect some Servers to Cortex XDR which should not connect directly to the Internet. In the first mind we talked about the Tier 0 server. Today I was asked why we cannot bring all the server under the umbrella of the Broker vm. I am a little bit unsecure to put about 100 server ont...

Cyber1985 by • L3 Networker
  • 5577 Views
  • 4 replies
  • 0 Likes

Integration between CDL and Rapid7 InsightIDR not working

I am working on the integration between CDL and R7 IDR SIEM and this is not working. I don't get pass the test connection on CDL. https://docs.rapid7.com/insightidr/palo-alto-cortex-data-lake/ https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-log...

Execute a program in my endpoint from live terminal Cortex XDR

Hi everyone, has anyone tried to execute a program in an endpoint from live terminal? I mean, when you are in the endpoint you can use a command like c:\notepad.exe in cmd and it opens notepad, I want to do the same but from the live terminal, I tried but I didn't have luck, it doesn't open the program. I really appreciate any help you can ...

Resolved! after cortex XDR 7.9.0.17288 upgrade endpoints in cortex XDR console got removed from existing dynamic group

Hi All, I have recently upgraded cortex XDR agent 7.9.0.17288 on few endpoints. After the successfull upgrade, i saw the endpoints which were upgraded with new version got removed from existing dynamic group. Those are still member the same group in AD, but not listing in the cortex XDR dymanic group. Is this expected behavior?

Cortex XDR folder exclusion - for Mac-Clients

How do i put a Folder on a Mac-Client in the Malware-Policiy-Profile into the Allow-List?For Windows-Clients, thats no big Problem, the Path always gets delivered with the Incident, but for Mac, the Path does not seem the Case, or, at least, i cannot put the Path into the Allow-List.Kind regards,Alex

Active Scanning on Endpoints

Hello, We intend to perform scheduled scanning on all endpoints. So we wondered if active scanning was required on all endpoints repeatedly, or if cortex developed its own scan whenever a new file was created or added to the system.

Cortex Filter on MacOS prevents internet connectivity

Hey everyone, We're having some issues with the most recent Agent Version on MacOS (7.9.0.2505). When some of our clients were upgraded to this version they suddenly lost internet connectivity. The only thing that worked for them was to remove Cortex XDR from under Settings -> Network -> Filters & Proxies, by pressing the minus but...

  • 2612 Posts
  • 98 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks