This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4488 Views
  • 0 replies
  • 3 Likes

Please update MITRE Techniques in BIOC module

Please update MITRE Techniques available in BIOC creation menu for Cortex XDR V3.16 Missing MITRE techniques in BIOC module: T1204.004 - User Execution: Malicious Copy and Paste - https://attack.mitre.org/techniques/T1204/004/ T1204.005 - User Execution: Malicious Library - https://attack.mitre.org/techniques/T1204/005/ I am sure these aren'...

D.Ogle by • L0 Member
  • 1171 Views
  • 0 replies
  • 0 Likes

XDR 4 - default playbooks error

Hi, someone have Cortex XDR 4? i my case, i've adopted some playbooks, and all playbooks have problems with configuration. Configuration using old json values (context values), for example:incident.id and correct is issue.id etc etc

tlmarques by • L4 Transporter
  • 479 Views
  • 0 replies
  • 0 Likes

Resolved! Broker VM shown disconnected

Hi, our Broker VM is shown disconnected on XDR console. The VM is up and running and I can connect to it via SSH. It can connect to the paloaltonetworks.com domain as I can see the traffic on firewall. Version is 25.0.44. Even the last seen is today, but the VM keeps shown disconnected. We have had similar problems with thin clients agents but t...

Denied URL - Broker VM

Hi team! Does anyone have or have had a situation where the applet local agent settings show "Denied url: URL_HERE"? Sometimes for short periods of time (around 5 -30 seconds) our broker VMs turn on in red the applet and we can see the message "Denied urls: ch-<xdr-tenant> .traps.paloaltonetworks.com " The URLs denied are different, ...

MarcoMJ by • L1 Bithead
  • 1857 Views
  • 3 replies
  • 0 Likes

Resolved! Rare Login Query Not Working

Hi team, I made a correlation query that looks for logins that haven't been seen on the servers in the last 7 days. This filters all successful login to endpoint type servers. preset = xdr_login_events | join type = inner (dataset=endpoints | fields endpoint_name, endpoint_type) as ep ep.endpoint_name contains agent_hostname | filter endpoint_t...

a2123k1 by • L1 Bithead
  • 2308 Views
  • 4 replies
  • 0 Likes

Hostfirewall Status Report

Hi Team, I am trying to fetch some report from Cortex XDR console. I would like to know how many endpoints has host firewall rule applied. How many endpoints still running with Windows firewall. Is there any script available to check.

Causality Chain

Hello,Can you please explain the difference between the causality chain of the 2 attached photos?What exactly are the executions?   

exeptions.png
issue.png

Resolved! Cortex XDR Windows 11 ARM64 Support?

Is there a plan or timeline for XDR being supported on Windows 11 with ARM64?I have a customer getting the error message "this version of Cortex XDR can be installed only on x64 architecture systems, please use the appropriate installation package."

pdysart by • L1 Bithead
  • 12244 Views
  • 16 replies
  • 1 Likes

Process injection into lsass

We received an alert indicating creation of a remote thread in the lsass process by the Cortex XDR agent (cyserver.exe). I noticed that during the same time period, there were a few other processes that got injected by the agent (e.g. explorer, svchost, wmiprvse, and other Palo executables). I am aware that it might inject a monitoring stub to p...

Resolved! Blocking PowerShell While Allowing Certain Powershell Scripts

Hi, good day! I need some help with configuring PowerShell restrictions in Cortex XDR. I'm currently facing an issue where Cortex XDR has detected a PowerShell script executed from a user endpoint. After investigation, we confirmed that this script is part of a legitimate IT department operation. Our goal is to allow specific, authorized Power...

How to delete Endpoints that have old agent and could not be uninstalled

Hello, I have 2 endpoints with old version: - 7.3.0.16740 on a server - 8.6.0.3704 on a computer I could not upgrade them and have no more access to those computers (in another country). I asked admin to uninstall, he did not. How to remove link between Agent and Cortex XDR server to recover the licenses. Thank you in advance for any help

S.MASSON by • L0 Member
  • 1194 Views
  • 3 replies
  • 0 Likes

Cortex Endpoint Isolation - Allowing Microsoft Intune

Anyone have tips on figuring out how to allow exceptions to successfully communication over the internet while an endpoint is in isolation? I would like Microsoft Intune to be able to continue to reach the device while the device is in isolation for the purpose of lock-down policy enforcement and location tracking. While I understand the isolati...

Parsing Rule - SonicWall NGFW

Your mileage may vary. Here's what I came up with [COLLECT:vendor="SonicWall", product="NGFW", target_brokers=*, no_hit=keep] alter raw_timestamp = arrayindex(regextract(_raw_log, "time=\"([^\"]+)\""), 0), device = arrayindex(regextract(_raw_log, "id=(\w+)\s"), 0), serial_number = arrayindex(regextract(_raw_log, "sn=([A-Z0-9]+...

Resolved! Evasion Technique - 1244315488

Hi, We are getting a few alerts for "Evasion Technique - 1244315488" - "Evasion technique using reflective loading." While investigating I can see that a base64 encoded PE file is written in the registry by taskhosw.exe under "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UCPD\DR\000" -The registry key is not super well documented (UserCh...

  • 2632 Posts
  • 99 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks