This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4322 Views
  • 0 replies
  • 3 Likes

Cortex XDR 7.4.1 in MAC having Malware Definition date as year 1970

Cortex XDR 7.4.1 in MAC having Malware Definition date as year 1970 in The Global Protect. Somehow, the AV definition date for Cortex in Global Protect is showing as 1970. User is not able to connect to Global Protect as its failing HIP match from the firewall that says the AV definition date should not be older than 7 days. Business is impact...

IOC Function

Hi Everyone, Until now, I cant understood a function from IOC in Cortex XDR.Could please share to me what's a main function IOC XDR?Because I have tried to create new rules, for block link m.facebook , like a picture. But, after that I have tried to access again, and the result I keep can access the URL.

MuhammadRusli_0-1629424930850.png

Cortex XDR block to execute Xcode Execution

In some of user cortex XDR agent blocking the Xcode simulator-trampoline program. Its detect as malware and Suspicious executable detected. when we show alert after some time wildfire score display Benign and low confidence so is it safe to allow that file in environment ? I have click on that file and check value in virus total portal but item...

DChavda by • L0 Member
  • 3657 Views
  • 1 replies
  • 0 Likes

Resolved! Device Control Violations & XQL

Has anyone been able to get a XQL Query together that could pull out the Device Control Violations ?Unfortunately at this point, while they are presented in Cortex XDR, I don't see a way to Export that page contentsSame with Disk Encryption Visibility, but at least with that one, there is at least a "Disk Encryption Compliance" Widget. But also...

Can't automate the Cortex agent for Linux install due to the RPM issues

We are having issues with rolling out Cortex using automation tools. Since the RPM doesn't take care of figuring out dependencies by itself, you need to manually go install those dependencies and then install the RPM. This makes installs messy and, since there are different distros and versions of Linux in the environment, this breaks the abilit...

Megawatt by • L0 Member
  • 4866 Views
  • 2 replies
  • 0 Likes

In-shell PowerShell commands not captured

As of at least 2020/07/10, I've only ever seen Cortex XDR capture PowerShell commands were included as parameters of a command-line process - never in-shell commands (opening PowerShell then manually executing the commands). Enabling PowerShell module auditing / logging locally doesn't make a difference. Is this a known problem? Examples below:

2020 ∕ 07 ∕ 10 15꞉05꞉16 - Rule_Builder_-_Cortex_XDR_-_Google_Chrome.png
2020 ∕ 09 ∕ 22 15꞉38꞉24 - BIOC_-_Cortex_XDR_-_Google_Chrome.png
2020 ∕ 09 ∕ 22 15꞉45꞉18 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png
2020 ∕ 09 ∕ 22 15꞉50꞉01 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png

XDR Prevent 7.2.0 Performance Issue on Win10 x64 v1903?

Has anyone upgraded to the 7.2.0 agent yet that has experienced performance issues? Like most persons our environment is constantly changing, but at the suggestion of someone at Palo Alto I upgraded my system to the 7.2.0 release last Thursday for another issue. A day later, before installing the September 2020 patches, my system stopped respo...

How to filter CIDR in XQL search

Hi, I'm trying to build XQL queries that target internal vs external IP ranges.This is easy in the normal query builder with 10.0.0.0/8|172.16.0.0/12|192.168.0.0/16 but I'm not able to re-create this in XQL. dataset = xdr_data | filter event_type = NETWORK | filter action_remote_ip not in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") I t...

  • 2589 Posts
  • 95 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks