This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4319 Views
  • 0 replies
  • 3 Likes

Resolved! Cortex Blocks system services

Hello everyone,the problem started a day ago, when Cortex XDR started to trigger the behavioral rule "other.malware_gen_task.105" on the service"System", when executing the child processes "smss.exe", "registry" and "memorycompression". It started without any previous changing.Have you got some information about this topic?Thanks

Http logs collector example not working

Hihope this is the right place to ask this questionWe were given a temp user to play around with the Cortex XDR and we are trying to insert some dummy data into it.I am trying to insert data using an Http logs collector, following this guideunfortunately, the example in the guide seems to be incorrect. I created a custom collector of HTTP type a...

Resolved! Differentiating mail from multi-tenant XDR

I am working with a multi-tenant XDR configuration and I would like to differentiate between the Alert Emails to ascertain from which tenant the Alert has been produced . For example: Tenant 1 and Tenant 2 (mssp). When I receive an email notification such as BIOC or LA Malware the content and subject does not provide me with any indication of so...

How can Cortex XDR Pro find the origin process from a DNS request if the process not uses DnsQueryEx RPC Call

Hi Community,Is somebody able to explain if Cortex XDR Pro is able to find the origin process if you have the DNS Query? A lot of windows internal process uses rpc calls to a svchhost.exe, which then makes the dns resolving, which is cortex xdr pro the source of a searched dns request. If i understand this articel right: https://stackoverflow.co...

fhu_omi by • L1 Bithead
  • 5288 Views
  • 3 replies
  • 0 Likes

Resolved! Cortex Change managing server

Hi Team, I'm seeing the different tenant address in Cortex xdr agent console it is connecting to another management server,Could someone please help me to replace the correct managing server name, Because currently that agent is not reporting to Cortex console but I can take remote of the machine where agent is installed

XQL - Hunt for Kerberos Relay Up Activity

Just posting, if this is useful for someone who might be hunting for Kerberos Relay Up (Privilege Escalation on Windows System) Activity.The purpose of this hunt is to look for suspicious logon on windows system using Kerberos Auth Package where the source of logon is localhost IP and user account is Administrator SID.dataset = xdr_data | filter...

Resolved! XDR agent not triggering alerts in the managements console while blocking

Hi, I have a rather peculiar issue(?) with one of my agents.Said agent is working as intended, however it blocked a certain file form running under "Local Malware Analysis". which is fine, but I did not receive any alert nor incident in the management console.while the end user received a notification that a file has been blocked, I received no...

Resolved! Where to get more information on "Behavioral threat detected (rule: create_renamed_script_engine_by_hash)"

Hello Cortex users, wondering if anyone has seen this before? We are getting a single host flagged with a large amount of "Behavioral threat detected (rule: create_renamed_script_engine_by_hash)" but when we investigate in Cortex XDR there is almost no information to go on. The process shows ::1 for the value, no path, command, PID, TID, MD5. ...

Securing old web server IIS6

Hello, We are solving a case of an IIS6.1 vulnerability on an old Windows 2008 R2 SP1 system. Microsoft no longer has support for Windows update. The customer cannot migrate to the newer system yet.Would Cortex XDR be able to secure IIS v6.1 web server vulnerabilities? Thanks!

Fido by • L0 Member
  • 3812 Views
  • 4 replies
  • 0 Likes

Resolved! Correct resolve types for XDR Incidents

Hi All, I tried to find this on PA Knowledge base but unsuccessful. Our team tries not to make exceptions/whitelisting unless absolutely needed. Therefore, I believe teaching Cortex XDR correctly on what is safe and what is not is crucial. For example when investigating successful logons from suspicious country (Low Sev Alert), if a user confir...

  • 2582 Posts
  • 95 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks