Filtering by Endpoint groups

I am trying to write an XQL query that will only focus on the endpoints that I have defined in my endpoint groups and not all endpoints in the xdr_data dataset.  

How can I filter the xdr_data dataset by endpoint groups?

Block md5 hashes

Dear team,

is it possible to block IOC based md5 hashes in cortex xdr?

admin applied agent tags

I have a few XDR deployments I manage and one this I miss is the ability to tag objects like I can on firewalls.

This would be useful for a number of tasks from:

- filtering views/dashboards/reports

- adding agents to dynamic agent groups

- assigning po

Status Cortex XDR

Hello community

Do you know where can i see the percentaje uptime of CortexXDR service?

I know about this link: Palo Alto Networks Cloud Services Status but it did not help me.

Cortex is not revoking non-persistent VDI license after user logout

Hi Community,

We have one golden image and non-persistent VDIs are spawning from it. we installed traps in the golden image with VDI enabled=1.  I can see the golden image install type is coming as a golden image, but the VDI generated from this has

Inconsistent XQL search results

When carrying out XQL search...."dataset = xdr_data | fields action_country | dedup action_country"

I receive a set of results with different action_country values as expected.

If I then take one of these values ie Switzerland and run "dataset = xdr_da

Cortex is not revoking non-persistent VDI license.

Hi Community,

We have one golden image and non-persistent VDIs are spawning from it. we installed traps in the golden image with VDI enabled=1.  I can see the golden image install type is coming as a golden image, but the VDI generated from this has

XDR sometimes blocks the use of left mouse clicks on Windows Start Menu

We've deployed the Cortex XDR agent version 7.1.2 to 50-60 end-user machines so far. 2 users have reported the agent has stopped the use of left mouse clicks on the Windows Start Menu and Search Box. Right mouse clicks work fine. As soon as we remove

Citrix XenApp - AV Exclusions - Non persistent Session hosts

Hi all, 

Anyone know if there are any optimisation guides for Cortex XDR in a XenApp non persistent enviroment ?

Should we add in some AV exclusions as mentioned by Citrix @ https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-pra

Agent 7.2 dont comunicate with broker vm

I proceeded to install cortex XDR on a Kali, respecting the installation parameter chmod + x Kali.sh - --proxy-list "proxysrv: 8080,10.250.1.34: 8080" However, the client cannot contact the broker the error it is a timeout. my query is the following,

Investigating ABIOCS

I'm investigating the cause of ABIOC alerts. We've seen one particular alert that appears to be a false positive but I'd like to get some more information to be sure and to understand these alerts better:

Name: Suspicious process accessed a site masq

BAT Script to uninstall Cortex using Agent cleaner with disabling tampering protection

Hi folks,

Could you help me plaease to know how can i create a bat script to execute Cortex Agent cleaner with anti tampering password to remove cortex agents?

I have to use bat because powershell is prohibited