This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4402 Views
  • 0 replies
  • 3 Likes

Resolved! Dynamic group "starts with"

Hi all,I need to create a dynamic group based on the first letters of device name, like "starts with" or "not starts with".I cannot use contains because, for example, I have server name that starts with QQ that should not be inside the group, but servers like ZZQQA01 should be inside.Is there any way to do this?Thanks

N2Z2 by • L2 Linker
  • 4022 Views
  • 3 replies
  • 0 Likes

Resolved! HIPS and Host Firewall

I would like to know whether Cortex XDR has Host Intrusion Prevention and Host Firewall capability. If yes, what is the difference and how to enable.

Resolved! Report exporting questions

I have a custom timer filed called analysttimer, which recording the time analyst spend on an incident, once the incident this field will shows total time spend. I can see the total time is captured in the analysttimer.totalduration field. When create a report, I can only refer analysttimer filed as whole in the widget, rather than directly ref...

Resolved! Behavioral Alert from Vulnerability Scanner - How to Allow Scans WITHOUT alerts from IP address?

We use an on-site vulnerability scanner that started triggering behavioral alerts on Cortex endpoints on Monday. These scans were disabled since they were very disruptive with some endpoints just reporting the issue and others blocking the scan. All endpoints received the pop-up alerting them to danger. These scans have been running since bef...

XDR endpoints not scanning

Is there a way to look at only the endpoints that have not been scanned in certain amount of time?I know I can view all the have been scanned in the last day/week/month etc, but I want to look at the devices that have NOT been scanned. I need a "does NOT equal" button, on the Endpoint Administration tab.

pdysart_0-1641414295405.png
pdysart by • L1 Bithead
  • 3790 Views
  • 3 replies
  • 1 Likes

Resolved! Cortex XDR Agent rollout strategy

We will be rolling out to production soon and we need to have full AV protection while Cortex XDR is in monitor mode for up to 2 weeks. The previous Cylance AV agent must be uninstalled prior to the Cortex agent being installed so running in parallel is not an option. Any thoughts on how other organizations have approached this or a recommend ap...

Log4j batch file execution

Hi All. From the Palo alto advisory as per below, we have to run a batch file via our SCCM tool. But I need to understand what version of log4j we are using on our Cortex. How can we find out , Please help To ensure you disable message lookup, follow the following steps:Disable Log4j message lookups environment variableXDR Pro customers - From t...

AsifSid by • L2 Linker
  • 3600 Views
  • 3 replies
  • 1 Likes

Use Cortex XDR to find host with ports 80,443 open

Hello - I'm totally new to Cortex XDR and its XQL - though I need to find machines in our environment that have ports 80/433 open. Is this possible via XQL? I started with these lines to see which column/s I could use for what I want to accomplish and I think it did not have it:dataset = xdr_data | limit 10 Please help! Thank youCortex XDR Cort...

XDR install not connecting

After getting a Tech Coordinator to remove the old Traps version, she rebooted, and downloaded and installed XDR version 7.5 that I had sent to her. However it shows it is disabled and will not connect to the server. Any advice?

pdysart_0-1640196661324.png
pdysart by • L1 Bithead
  • 3164 Views
  • 2 replies
  • 0 Likes

Resolved! Cortex Xdr Cytool Linux Force Reconnect

hi ,I'm trying to create a Python script that I can run from managementto change the Installation Package value,something like this;import osos.system('/opt/traps/bin/cytool reconnect force ecXXXXXXXXXXXX5efdbe920')I was already able to create one like this for my Windows machines, and there it was more complex because I had to assemble the pass...

Resolved! Is it possible to search for Macros in Cortex?

Can Cortex see if macros have been launched on an endpoint, specifically Office Macros? I tried the "All Actions" query and searched for .doc and .xls files but no luck. Has anyone tried to search for macros using Cortex query or xql? Just to clarify, I was trying to hunt for any macro executions seen on our endpoints whether they are maliciou...

Cortex agent got uninstall automatically

Hi All, Last night Cortex agent got uninstalled automatically on my system and then I had to install it back manually. There are no logs in agent audit logs for this in cortex console. We need to find out why this was uninstalled automatically. Will windows event logs help? Any suggestions RegardsAsif Siddiqui

AsifSid by • L2 Linker
  • 3172 Views
  • 2 replies
  • 0 Likes
  • 2612 Posts
  • 98 Subscriptions
Top Solution Authors
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks