This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4322 Views
  • 0 replies
  • 3 Likes

Need to extract installed application.

Hi, I have queries regarding cortex XDR, Does the cortex xdr provide application inventory counts? We want to extract each and every application which is installed in all our network systems but with IP. for e.g, 10.10.10.10 is a system IP, I want to extract how many other applications are installed in this particular IP. From host insight, we g...

Problem uninstalling Cortex XDR Agent

I often have the problem that the host loses connection to Cortex console due to a failed agent update and I cannot uninstall the agent on it and reinstalling the agent results in a rollback. There is a file named "tdevflt.sys" left in the "C:\Program Files\Palo Alto Networks\Traps" folder that prevents me from reinstalling the agent. The only t...

Scott103 by • L0 Member
  • 6248 Views
  • 2 replies
  • 0 Likes

Query Builder to XQL

I have built queries within builder that I cannot replicate in a xql queryIs there a way to convert them quickly?The example below was built with the builder, a search for files within removable media for the previous 24 hoursI need it in xql syntax in order to create widgets...etc File [ action type = all AND device type = removable media ] AN...

Resolved! Cortex XDR Agent and system logs

Hello All, I am trying to get logs for cortex XDR agent of more than 1 month old, from system and tech support file however not getting any success. Does anyone knows any method by which we can retieve agent logs/tech support logs for more than 1 month old data? Is it possible to retrieve such logs form cortex XDR agent? Thanks in adavance.

tejasp04 by • L1 Bithead
  • 20852 Views
  • 1 replies
  • 0 Likes

XDR agent quota exceeded

We're running 7.4.x currently and we've been seeing a ton of these alerts lately, and it seems to be for the same four or so machines out of several thousand. It is just alert after alert. I checked the log folders on the machines and they aren't anywhere near full for what we set for the log folder limit. I even emptied one of them and it was s...

enewman by • L1 Bithead
  • 4678 Views
  • 2 replies
  • 0 Likes

Trying to setup Cortex Data Lake

Hi all, I am new to this forum and new to the job where I am having this issue so please forgive me if this is an easy question that has been answered, I could not find the info I was looking for. I am trying to setup a Cortex Data Lake for my Cortex XDR Cloud logging. I am aware that I cannot see anything in the data lake when going to explor...

All Cygwin apps see the decoy files

Hi. My organization forced the installation of Cortex XDR 7.4.2.35695 on my workstation and When I use Cygwin it lists the anti-ransomware decoy files. It's especially troublesome when I copy directories because real files are created then.ncdu 1.10 ~ Use the arrow keys to navigate, press ? for help --- /cygdrive/c -----------------------...

Resolved! Cortex XDR Forensics Addon

Hello everybody.I have a question about Cortex XDR Forensic addon. When we enable Forensic addon from Agent Settings profile we see "Interval Hours" for each section. But we can not understand what it is. Also we can not find anything about it in any documentation. Can anybody explain this option ("Interval hours") please?

Move an Endpoint agent to another tenant

How to move an Endpoint agent to another tenant? I just tried to transfer a Cortex XDR agent from one tenant to another tenant. But unfortunately, the said agent is keeping listed at the current tenant rather than the new tenant.

High memory consumption on newer agent versions

Hello everyone, I have sporadic servers in our environment producing high memory consumption with the XDR agent. Cyserver.exe will climb to 350-400mb in some instances until the service is rebooted and it brings it down to an acceptable level. Has anyone else had this issue before? It's not on all devices either which makes it a pain to trouble...

CraigV123 by • L3 Networker
  • 22263 Views
  • 5 replies
  • 0 Likes

Advanced Training For Cortex XDR

Hi all, Does any of you support members, or experienced Cortex XDR users know if there's reasonably priced advanced training for the platform (on-demand or instructor-led). Please I'm not talking about the on-demand training available at this link as those tend to be basic and not well organized. I'm referring to well-arranged training that ta...

How to add IP to the XDR whitelist without any security analysis

My user generated a behavioral threat alert, which caused the two PCs to not be able to communicate with each other. After we turned off the protection function of xdr agent, they were able to communicate with each other. I did not see the block ip on the XDR cloud server. Someone Can you tell me why?I added allow ip below but it did not take ef...

  • 2589 Posts
  • 95 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks