This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4728 Views
  • 1 replies
  • 3 Likes

Resolved! Cortex XDR - Endpoint/Incident API Limit (100) - PowerBI Query

I am attempting to pull in endpoint/incident data using the appropriate API in PowerBI. However, there's a limit of 100 . I tried adding a separate custom column anticipated that my total number of incidents would be let's say "x" value, but that just repeats the already pulled 100 rows. See a copy of the Query I am using below: letbody = "{ ""r...

Cortex XDR disk encryption

Hello, I can't turn off disk encryption. I disabled the disk encryption policy for an endpoint, then the encryption status returned as not configured. But I can still see bitlocker on the endpoint is ON. How can I turn off bitlocker on endoint not manually but via cortex XDR? Thanks!

Citrix PVS servers consuming multiple Cortex XDR licenses

Hi all, We're having an issue where Citrix PVS servers running Cortex XDR consume a new XDR license every time they reboot. I don't fully know how PVS works, but essentially from what I can gather is upon booting up, it pulls a copy of an image from the master and loads into that, and these servers are configured to reboot every night - thus rep...

Untitled.png

How to get the list of alerts/incidents for a particular list of hosts?

Hi,I need to know how can we get alerts for particular hosts/ a specific group ( Ex: 1000 agents ) in the Cortex XDR console -> Incident Response -> Incidents -> Alerts table. I have tried from filter option but it doesn't work. We can't add all the agent names in the hostname for the 1000 servers as it is time-consuming. So, is there a...

CIDR Lookup or Join for IP Enrichment

I would like to use some custom datasets to enrich some of our XQL searches. It could be our subnets from our IPAM or in this example the ASN information. I have used lookups and joins in the past to accomplish this in others tools and would like to do the same with Cortex XQL. I did look at incidr and incidrlist but it seems to be the opposi...

Verdict of VT and WildFire

Hello Team, From XDR console, we wanted to export alerts includes verdict from WildFire and Virus Total which we are not getting. Can anyone help me with XQL query or other way to get verdict (for e.g. Process: Excel.exe WF Verdict: Benign and VT score 0/65) includes in exported alerts. Cortex XDR

macOS Big Sur - how to automate full install, eliminate manual approval of system extension files

we are still manually installing Coretex to our Macs on Big Sur, this involves some time and the hope that our human computer builder / imager doesn't forget to manually approve PMD and Traps extensions. Is there a method where we can use a script install and automatically approve the installation of Coretex XDR version 7.3.0 build 2207? if it...

XQL question command line with " to XQL query

Hello dear community, is there a way to put the whole command line into the XQL query? As you can see the doublequotes are already set by the command line itself. In SQL I know to do it whith extra double quotes ""XYZ"". But how does that work with XQL? BR Rob

RFeyertag_0-1655932695568.png
RFeyertag by • L4 Transporter
  • 4520 Views
  • 3 replies
  • 0 Likes

Cortex XDR Postman API Collection

Simplify each step of building an API and streamline collaboration so you can create better APIs faster with Postman. Read Cortex XDR Postman API Collection to learn more on this topic from our experts! Palo Alto Networks Contributor: Tiago Vilas, Cortex Customer Success Architect

nhussaini_0-1635367774193.jpeg
nhussaini by • L4 Transporter
  • 3293 Views
  • 1 replies
  • 3 Likes

A question from the Alert Tuning Operations Webinar: Signing level in a child process

We have a mac-device on which even a reinstalled chrome creates child processes (Google Chrome Helper) that are apparently below the signing level of the parent process. Their signatures seem to be valid. Seems like whitelisting the hash of the initiator is not the best idea. What would be the best process if a child's process is blocked due to ...

rtsedaka by • L6 Presenter
  • 2782 Views
  • 1 replies
  • 0 Likes
  • 2674 Posts
  • 103 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks