This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4496 Views
  • 0 replies
  • 3 Likes

Resolved! Evasion Technique - 1244315488

Hi, We are getting a few alerts for "Evasion Technique - 1244315488" - "Evasion technique using reflective loading." While investigating I can see that a base64 encoded PE file is written in the registry by taskhosw.exe under "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UCPD\DR\000" -The registry key is not super well documented (UserCh...

Cortex XDR - Automation Rules

Greetings,Im trying to configure "Automation Rules" to "High" severity issues for the automatic isolation of endpoints. Right now its configured as the following images show, but theyre not triggering the playbooks nor rules. ¿Any ideas or suggestions on why its not triggering?

LAguero_0-1761831187524.png
LAguero_1-1761831211623.png
LAguero_2-1761831227232.png
LAguero_3-1761831271872.png
L.Aguero by • L0 Member
  • 1517 Views
  • 3 replies
  • 0 Likes

high priority 'Behavioral Threat' alert for smss.exe (system)?

Every few weeks or so getting a high priority alert: 'Behavioral Threat' generated by XDR Agent detected on host <some_WS2019_server> involving user system Priority: High Behavioral Threat Source: XDR Agent Behavioral threat detected (rule: sync.vulnerable_driver_by_original_name_loaded_procexp) User name SYSTEM Action ...

kindzma_0-1728399273223.png
kindzma by • L2 Linker
  • 4353 Views
  • 4 replies
  • 1 Likes

xql query for process

Hi. i just try to do some basic threat hunting. dataset = xdr_data| filter action_process_image_name in ("a.exe", "b.exe")| fields agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line , _time| sort desc _time so i try to identfied two different process is happening at same endpoints. how to do...

T.Nurmi by • L2 Linker
  • 1331 Views
  • 1 replies
  • 0 Likes

Resolved! Can Cortex XDR fully substitute for Microsoft Defender Attack Surface Reduction (ASR) rules?

Hello Cortex XDR Community, We are in the process of transitioning our endpoint security stack and are using Cortex XDR as our primary AV/EDR solution, with Microsoft Defender offboarded. Our goal is to have a single, fully functional security control plane within Cortex. We have a detailed set of Microsoft Defender Attack Surface Reduction (ASR...

atief by • L0 Member
  • 3658 Views
  • 1 replies
  • 0 Likes

Cortex XDR markertspace

"I recently installed the Microsoft Teams add-on in Cortex XDR markertspace, but I'm not sure how to configure it or where to navigate. After adding the add-on, where can I find it and how can I use it?"

Cortex XDR update from V3 to V4

Hello everyone! Hope you're doing it great. This week on my cortex XDR console a notification appeared saying that an update to the V4 of the tenant is available. That sounds great, but I'm concerned about what's the impact on my already deployed agents. Are they going to be disconnected and another deploy would be necessary? Have anyone h...

cortex 4.png

Resolved! Cortex XDR - API Automation

Hello,I am currently trying to code a Script with Cortex API in order to check the version of the latest available Agent. I am talking the precise agent version not like 5.X but the 5.X.XXXX.I haven't seen anything in their actual documentation, perhaps I missed something.Hope someone can help me outThanks a lot!

Monitoring PowerShell Command

Hello everyone!I received an alert about PowerShell with the DCsync rule.I'd like to check if I can see the code that PowerShell executed. I can only see the "PowerShell_ise.exe" process. I don't know what code or command generated the alert. There is a possibility that it is a script code, but I would like to identify it better.

  • 2633 Posts
  • 99 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks