Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Resolved! I found many event about "EDL Authentication fail" on Management Audit log at Cortex XDR console since Mar 17,2022 until now.

Hi ,

I found many event about "EDL Authentication fail" on Management Audit log at Cortex XDR console since Mar 17,2022 until now.

But I didn't enable EDL why I got this event that was generate every minute . Please advise how to clear this event .

...

The data ingestion dashboard and datasets do not correspond

Recently, by purchasing a per TB licence, I integrated the logs of the Fortinet firewall, but I found that the daily data volume in the data ingestion dashboard and the log volume in the Fortinet datasets do not match. The dataset of the Fortinet onl

...

Deploying XDR Agent for MacOS with Microst InTune

Hello,

Found several threads on this topic, but no clear solutions.
Do we have en working solution with a clear description ?

Cortex XDR + CDL - Raw Log file integrity and tamper protection

Hello,

I have been digging through various Cortex documentations to find explicit language around log integrity, tamper protection of logs from administrators. I am aware that RAW Logs are not accessible to tenant admins however, could you point me i

...

'Hijacked DLL Injection' alerts

Greetings ,

The single most common and repeating alert which we are getting is like below :

'' 173 'Hijacked DLL Injection' alerts detected by XDR Agent on 24 hosts ''

Explanation is 'DLL attempted to load from blacklisted location' .So 2 questions her

...

XDR flags Chrome as malware on ubuntu endpoint

Hi folks, got a problem that i would like som input on.

I have an ubuntu endpoint with a xdr agent installed. said agent has given me a high severity alert about several items on this ubuntu endpoint - Kite(which, seeing how kite can install itself au

...

API Pagination

Hi community, I am new here.

I am trying to integrate the Cortex XDR API for incidents into Azure Sentinel using the new Codeless Connector Platform (CCP). The challenge I have is that the Cortex API doesn't appear to have any indicator as to where

...

upgrading endpoints from the Cortex Console, 50% success rate. spot checks show "Upgrade by SAM failed"

Hi Everyone,

we have been trying to upgrade some endpoints from 7.2.2 to 7.5.1 but the success rate on the first push was 50%. on the second push again 50% on the left overs from the first push. the logs are showing ""Upgrade by SAM failed"

2022/0

...

Resolved! XDR integrates Fortigate but doesn't see data in dataset

First of all, I have a per TB license, so today I integrated the data of the fortigate firewall, forwarded it to the broker through the log, and opened the syslog applet on the broker. Configured according to the admin guide, the firewall is given to

...

Resolved! What is the relationship between XDR and Datalake

I saw that there is datalake in the official admin guide structure, but I don't know what datalake does. I bought 200 XDR pro licence and found that my account has more datalake, which has 1TB of storage space. I am very confused. What data is it use

...

Resolved! create custom xql widget

Any guidance to create custom xql widget for ingestion data, such as the screenshot? Thanks in advance

Completely silent XDR install command line switches.

Looking for some insight on how to automatically accept the license during agent installation.

deploy broker vm proxy configuration

hello,

i want to install cortexXDR throught SCCM on my servers but i'm facing an issue with setting the proxy parameters also to type the confirmation password.

How it's possible to do it?

any help please?

BR.