This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4322 Views
  • 0 replies
  • 3 Likes

XQL - Hunt for Kerberos Relay Up Activity

Just posting, if this is useful for someone who might be hunting for Kerberos Relay Up (Privilege Escalation on Windows System) Activity.The purpose of this hunt is to look for suspicious logon on windows system using Kerberos Auth Package where the source of logon is localhost IP and user account is Administrator SID.dataset = xdr_data | filter...

Resolved! XDR agent not triggering alerts in the managements console while blocking

Hi, I have a rather peculiar issue(?) with one of my agents.Said agent is working as intended, however it blocked a certain file form running under "Local Malware Analysis". which is fine, but I did not receive any alert nor incident in the management console.while the end user received a notification that a file has been blocked, I received no...

Resolved! Where to get more information on "Behavioral threat detected (rule: create_renamed_script_engine_by_hash)"

Hello Cortex users, wondering if anyone has seen this before? We are getting a single host flagged with a large amount of "Behavioral threat detected (rule: create_renamed_script_engine_by_hash)" but when we investigate in Cortex XDR there is almost no information to go on. The process shows ::1 for the value, no path, command, PID, TID, MD5. ...

Securing old web server IIS6

Hello, We are solving a case of an IIS6.1 vulnerability on an old Windows 2008 R2 SP1 system. Microsoft no longer has support for Windows update. The customer cannot migrate to the newer system yet.Would Cortex XDR be able to secure IIS v6.1 web server vulnerabilities? Thanks!

Fido by • L0 Member
  • 3824 Views
  • 4 replies
  • 0 Likes

Resolved! Correct resolve types for XDR Incidents

Hi All, I tried to find this on PA Knowledge base but unsuccessful. Our team tries not to make exceptions/whitelisting unless absolutely needed. Therefore, I believe teaching Cortex XDR correctly on what is safe and what is not is crucial. For example when investigating successful logons from suspicious country (Low Sev Alert), if a user confir...

Java Deserialization Protection

Hello,I am looking to enable the "Java Deserialization Protection" in my exploit profile. I see the default is to leave it disabled. anyone else have this enabled?any advise or experience working with this?

P.Jacob by • L3 Networker
  • 5302 Views
  • 3 replies
  • 1 Likes

Getting Multiple alerts about file "TwitchClient.exe"

I'm getting multiple alerts about the file "TwitchClient.exe" which is under below path C:\Program Files\WindowsApps\AdvancedMicroDevicesInc-2.AMDRadeonSoftware_10.21.10043.0_x64__0a9344xs7nr4m\radeonsoftware\twitch\TwitchClient.exe Is this file is a legitimate file or do we need to worry about it.

Cortex XDR - Whitelist services in properway

Hi All 😄I'm new to Cortex XDR Hub and i'm trying to manage somes clients in the right way.I got this situation:There are some clients who had used IoBit - DriverBooster for the drivers installation on the machine.A lot of services about this application it's matched like Greyware or "Bad signature"Soo for first step i checked all the services w...

mgussoni by • L0 Member
  • 5794 Views
  • 2 replies
  • 0 Likes

Resolved! macOS Network Filter limited to no more than one active network service on M1 Mac

Hi, I'm an enduser of Cortex XDR. Recently my workstation was migrated from an Intel MacBook Pro to a M1. During the migration process, both workstations were on macOS Monterey 12.3.1. I've discovered on the M1 that with the Cortex XDR network filter present in Network, I cannot have more than one network service active. Examples: wifi and ether...

Resolved! Query Network

Hello XDR Community! when the network (see screenshot) will be depprecated, will it be possible to get all the informations under network connections? I don't get the same results and not dst_host which would be very usefull. Here is my Query:Network [ action type = all AND remote ip = XXX.XXX.XXX.X ] AND Time [ event timestamp in last 24H befo...

RFeyertag_0-1649460837699.png
RFeyertag by • L4 Transporter
  • 4608 Views
  • 4 replies
  • 0 Likes

Server Core

Is it possible to install Cortex on a Server 2019 core edition? There is no graphic interface but we'd like to have Cortex running on all our servers. Thanks!

  • 2589 Posts
  • 95 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks