Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

In-shell PowerShell commands not captured

As of at least 2020/07/10, I've only ever seen Cortex XDR capture PowerShell commands were included as parameters of a command-line process - never in-shell commands (opening PowerShell then manually executing the commands).

Enabling PowerShell modul

...

2020 ∕ 07 ∕ 10 15꞉05꞉16 - Rule_Builder_-_Cortex_XDR_-_Google_Chrome.png

2020 ∕ 09 ∕ 22 15꞉38꞉24 - BIOC_-_Cortex_XDR_-_Google_Chrome.png

File reads not returned

The file event search is supposed to support reads but I've never seen it work.

Is this a known problem?

Examples:

2020 ∕ 09 ∕ 22 16꞉42꞉38 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png

2020 ∕ 09 ∕ 22 16꞉43꞉29 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png

View general forensic timeline for endpoint

Is it possible to view the forensic timeline for an endpoint in general, not only for information that the system thinks is relevant to a specific incident?

If not, can this be added?

XDR Prevent 7.2.0 Performance Issue on Win10 x64 v1903?

Has anyone upgraded to the 7.2.0 agent yet that has experienced performance issues? Like most persons our environment is constantly changing, but at the suggestion of someone at Palo Alto I upgraded my system to the 7.2.0 release last Thursday for a

...

How to filter CIDR in XQL search

Hi, I'm trying to build XQL queries that target internal vs external IP ranges.

This is easy in the normal query builder with 10.0.0.0/8|172.16.0.0/12|192.168.0.0/16 but I'm not able to re-create this in XQL.

dataset = xdr_data 
| filter event_type =

...

Install a version 7.4.1 cortex XDR on a file server

Hello,

Did something install version 7.4.1 on a file server, and the server works without problems?

Thank you

Cortex XDR Tests

Hello everyone

Can I install environment testing? Can I please explain?

Thank you

Resolved! Access cortex xdr been disabled

Hi,

How do I allow users to open the cortex on devices?

Thank you

Resolved! Devices that are down cortex XDR

Hi,

I have devices that are down, how can I find them? In the interface, I only see the devices in status connected or disconnected

Thanks.

high memory use (700M)

agent 7.4.0

high memory use-738M

I take log support and uninstall the program, it's happening only on one computer.

what should I check on the support log? there is so many file and log...

Resolved! Hivenightmare

Hivenightmare (CVE-2021-36934) has been out for a few weeks and with no MS patch yet, i was wondering if anyone has done anything in Cortex XDR on to help with this? Maybe alerting if SAM files being access or anything like that?