Cortex XDR Issues with macOS Sequoia 15.2 and Airplay

We’ve noticed that with Cortex XDR installed on a MacBook running macOS Sequoia 15.2, AirPlay functionality no longer works for presentations. When attempting to connect to Apple TV via AirPlay, the connection times out. The native macOS firewall is

FTP Transfer Custom BIOC

Hello Palo Alto LiveCommunity,

I’m currently working on a task where I need to create a custom BIOC (Behavioral Indicator of Compromise) and add it to a restriction profile to block FTP command lines. Specifically, I want to prevent FTP-related com

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

1. Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

LSA Protection and antimalware DLL loading

We currently have deployed LSA Protection and code integrity in Windows 11 (build 24H2).

Cortex XDR agent 8.6.0 is installed. When trying to load a DLL from another security tool (Ivanti Device and Application Control), Code Integrity is blocking the

USB drive Alert

kindly we need your support, I want to get alert when a USB drive is connected to workstation and not blocked by Symantec AV.

I have tried several times with correlation rule, I found XQL query very effective, and it is as follows:

Receiving unwanted notification from cortex XDR on IOS

Dear all,

Kindly note that we are receiving when exiting the cortex XDR APP always the notification : 

Cortex XDR: App terminated!
The agent is not running
Tap to open the Cortex XDR app and leave it running in the background ( also image attached to

Install Cortex Agent on on-prem k8s

Hello, 

Anyone have experience installing XDR agent on on-prem cluster with docker installed.

The agent compatibility matrix mentioned XDR version 8.6 is supported 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Compatibility-Matr

Cortex Installed

expensive,

Would you have an xql where it brings from the machines in my park which ones have the cortex installed or not?

Unable to install Cortex XDR agent!

We are encountering an error during the installation of the Cortex XDR agent on one of the machines.

"Cortex xdr requires rollback/Commit to be enabled"

Could you kindly provide the solution to resolve this issue?

Cortex XDR 

Difference between system reboot and agent services off

Hi,

We have to configure 3 alerts that are sent via email.

Condition 1:

When cortex agent services are stopped then raise an alert via email.

Condition 2:

When system is powered off/turned off then wait will 10 minutes, if systems do not come b

XQL: Anyone has working example of building analytics on XQL query?

We want to build analytics using XQL where we could find or create an alert if certain behavior has occurred for the first time on endpoint.

Currently, we use external help where we run XQL schedule query and then retrieve results and run python sc