This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4325 Views
  • 0 replies
  • 3 Likes

How to Block Mobile Phones (iPhone/Android) via USB Using Device Control

Hi everyone, I'm currently working on a Device Control policy in Cortex XDR and I need to block mobile phones (iPhones, Android devices, etc.) when they are connected via USB — similar to how USB drives and external disks can be blocked. I understand that Cortex XDR uses ClassGuid to identify device types (https://docs-cortex.paloaltonetworks....

Cortext Modifying App Java Threads Without Warning

Cortex is currently messing with a java app at a customer site. We have a tomcat-based java app that we take to market. Cortex is currently messing with it. Cortex on, our app has issues. Cortex off, our app runs fine. Copy the entire folder and run on a different box without Cortex, the app runs fine. Major problem is Cortex is not throwing...

dvs2025 by • L0 Member
  • 832 Views
  • 1 replies
  • 0 Likes

Cortex Prevention Profiles

Hi Team, Customers found a few of the security modules disabled by default and they wish to enable the modules.- Below are the modules that the customer wishes to enable for the endpoints.“Agent Certificates”, “Data Generation Providers”, “PowerShell Script Files”, “On-Write File Examination”, and "VB Script modules".- We have provided the custo...

H.Patri by • L1 Bithead
  • 549 Views
  • 1 replies
  • 0 Likes

Endpoint is isolated

Basically I have a laptop loan from a school for the fall term, I downloaded a game which was counter strike source which I owned to keep me busy during breaks. Cortex basically told me it was a “Virus” and then ended my internet connection, Now I can’t use the laptop for schoolwork. How do I fix this?

tacbig01 by • L0 Member
  • 805 Views
  • 1 replies
  • 0 Likes

Resolved! XQL Help - Any AI tools, query library?

Wondering if there are plans to help build queries? Something as simple as looking for a file called "testfile" requires the query with the below code: |preset = xdr_file|filter action_file_name contains "testfile" Another example that we are currently working on is a way to search for specific models of computers. As an example: "find all Latit...

J.Suter by • L2 Linker
  • 3173 Views
  • 4 replies
  • 1 Likes

XQL help to detect when a process is stop or killed and by whom

Hello community, I'm trying to create a XQL Query to detect whenever a user is stopping a particular service (via services.msc, cmd, powershell, WMI or any other way), but I can not do it. I need to detect the user that send the stop service command, or the user that is killing the process. Is it any way to make this query? This is the c...

jrlambea by • L0 Member
  • 943 Views
  • 2 replies
  • 0 Likes

Resolved! Quarantined File Automatically Moved to Allow List from Block List after File Restore Action

Have an interesting behavior that I was curious if anyone could clarify or validate. We recently enabled quarantine through malware profile/policy for VB Scripts Examination a feature just recently added to Cortex XDR v8.9. As such a hash that was previously added to block list quarantined a .vbs file by sha256 and an end-user contacted us repor...

Create custom widget to display data from Jamf

Hi Everyone,I'm wondering if it's possible to fetch data from JamfPro MDM solution for example user_name, ip address and mac details and add it as a custom widget to the cortex dashboard. If this is possible kindly guide me on how to achieve this.#apiIntegration #scripting #cortex_xdr

H.Patri by • L1 Bithead
  • 622 Views
  • 2 replies
  • 0 Likes

Resolved! CORTEX XDR Cloud Inventory AWS Region TEL AVIV is fully supported?

Cloud Inventory in Cortex XDR is not detecting our assets in the AWS Tel Aviv region, while it does detect assets in other regions, even though the configuration and permissions are valid according to Cortex XDR SaaS. Is this a bug, a limitation, or is the region not fully supported? In the documentation, nothing indicates that the region is un...

Upgrade Tenant 3.x to 4.x question

Hi Expert , I would like to know or anyone have experience about upgrade tenant cortex xdr from 3.x to 4.x if older we have just prevent lic and then have to upgrade lic to pro can upgrade existing 3.x to 4.x ? Thank you

Resolved! How endpoint devices, XDR Broker VM and XSIAM Cloud communicate in case of HA configuration

Hi Team, I'd like to know how endpoint devices, XDR Broker VM and XSIAM Cloud communicate in case of HA configuration. I guess HA configuration may require a virtual IP address to receive logs from endpoint devices and to send the logs to XSIAM Cloud. For example, there are 3 IP addresses. (1)Broker VM A : 10.0.0.5 (2)Broker VM B: 10.0.0.6 ...

miyaito by • L0 Member
  • 828 Views
  • 1 replies
  • 0 Likes

Resolved! Cortex not allowing specific Bluetooth devices to connect

We have been testing device blocking using Cortex. We have noticed that some Bluetooth devices (Apple Air Pods for instance) are not being allowed to connect/pair. I do not see a setting specifically for these types of devices, and I have been unsuccessful in my searches as well. Anyone else seen this issue?

Cortex XDR Agent setup

Hi folks do you have idea from where i can download Cortex XDR Agent 8.8.1 MSI file, we wanna to run a batch script for uninstall it PS: our license its expired and we cannot get it from the XDR portal

A.Warid by • L0 Member
  • 621 Views
  • 1 replies
  • 0 Likes
  • 2591 Posts
  • 97 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks