Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

 

Rules and Best Practices

 

  1. Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion
...

JayGolf by Community Team Member
  • 267 Views
  • 0 replies
  • 2 Likes

Resolved! Accessing Files While Scanning

Hello, this might be a dumb question but I'm trying to find any documentation that might back it up.

 

Basically, when conducting a system scan some apps can't be executed because they try to access certain .dll files which are being used or are open b

...

Authentication BIOC rule

Currently, I can create one-off or scheduled queries for authentication data / events but not BIOC rules which isn't ideal because scheduled queries don't create incidents.

 

Is it on the roadmap to add this ability?

 

Thanks.

2020 ∕ 09 ∕ 22 15꞉28꞉02 - Query_Builder_-_Cortex_XDR_-_Google_Chrome.png
2020 ∕ 09 ∕ 22 15꞉30꞉54 - Rule_Builder_-_Cortex_XDR_-_Google_Chrome.png

Timeframes for BIOC rules

It'd be very useful for things like failed logons or network connection attempts if BIOC rules could utilise timeframes.

 

Is this on the roadmap?

 

It could work well if this was done in a similar way to NGFW → OBJECTS → Custom Objects → Vulnerability →

...

2020 ∕ 09 ∕ 23 10꞉52꞉33 - PA_LAB_-_Google_Chrome.png

Demisto : How to display List of Messages

Hi Team, I am using create_incident API to create incidents. Below is the sample code. I can create an incident when I use "messages" as String.  Basically, this is custom_fields and its data vary from incident to incident.  Some incidents may have 

...

Screenshot from 2020-10-22 22-29-37.png
JSannake by L0 Member
  • 2440 Views
  • 1 replies
  • 0 Likes

Mitre ATT&CK techniques missing

After reading https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-release-notes/release-information/features-introduced/features-introduced-in-2020.html#ide2559432-5eb3-4f83-8e85-c4159aeed9ed → "MITRE Tags Enhancements", I retroactively ad

...

2020 ∕ 09 ∕ 22 16꞉15꞉16 - BIOC_-_Cortex_XDR_-_Google_Chrome.png
2020 ∕ 09 ∕ 22 16꞉15꞉27 - Hide_Artifacts,_Technique_T1564_-_Enterprise__MIT.png

Resolved! SaaS Log Collection

Can't find SaaS Log Collection to start ingesting external logs into Cortex XDR.
 
All the documentations state: Click Gear > Settings > SaaS Log Collection
I can't find it, I currently have Cortex XDR Pro Per Endpoint, does this license not support ing
...

Web filtering in Cortex?

Hello,

 

We have just recently implemented Cortex XDR for endpoint protection and have a question about web filtering.  Are there profiles/polices in Cortex XDR that can enable any web filtering features or is web filtering strictly a firewall feature?

...

bsuprai by L0 Member
  • 6097 Views
  • 1 replies
  • 1 Likes

Client groups in Cortex XDR

Hello,

 

We are an existing Palo customer and we are moving to Cortex XDR for our Antivirus solution. In our current AV application we have groups for different clients based on exceptions or application for various reasons. It is very easy to create i

...

Unable to upgrade Traps from 5.0.x to XDR 7.2

Hi Community,

 

I am unable to upgrade the Traps agent from v5.0.x to 7.2 using the rule from XDR console. I have upgraded from 6.0. Not sure whether my antivirus is blocking it.

I can see the version is showing as upgraded in the console for a while th

...

  • 2151 Posts
  • 83 Subscriptions
Top Liked Authors