This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4322 Views
  • 0 replies
  • 3 Likes

high memory use (700M)

agent 7.4.0high memory use-738MI take log support and uninstall the program, it's happening only on one computer.what should I check on the support log? there is so many file and log...

EliyaD by • L0 Member
  • 3821 Views
  • 2 replies
  • 0 Likes

Resolved! Hivenightmare

Hivenightmare (CVE-2021-36934) has been out for a few weeks and with no MS patch yet, i was wondering if anyone has done anything in Cortex XDR on to help with this? Maybe alerting if SAM files being access or anything like that?

D_BB by • L0 Member
  • 2633 Views
  • 1 replies
  • 0 Likes

alert question-Agent Uninstalled

I receive alerts from my siem, that the XDR sent alert agent uninstalled and the computer name is it1179128192 I asked our help desk and they say that we don't have a computer with this name. Where can I found information about this activity I want to get the mac of this computer.

EliyaD by • L0 Member
  • 2236 Views
  • 1 replies
  • 0 Likes

'HTTP/2 500 server' Error while requesting XQL query result over API

hi there, I'm quite new to cortex, gone through the guide available on the site but nothing related to the following error: HTTP/2 500 server: openresty/1.15.8.2 date: Sun, 18 Jul 2021 05:26:48 GMT content-type: application/json content-length: 131 strict-transport-security: max-age=15724800; includeSubDomains x-frame-options: sameorigin {"repl...

Cortex XDR: Allow list behaviour

Hi all, One week ago I added an artifact (hash) to the allow list. This hash was deteced (reported) by the XDR Agent. Today, I have a new incident, only related with the same artifact(hash) (different host). I was expecting of not seing any incident related with this artifact if it is the ONLY related to. Which is the behaviour then of the Al...

Resolved! "Error downloading content, error code 3" -- Upgrading 7.3.1 to 7.3.2 XDR Endpoint (windows)

Wondering if any one might have insight of why and what the following means in the trapsd.log for a few systems that have yet to automaticly update themselves to 7.3.2 (Also find if in console, and set the agent to upgrade, its still reflecting 7.3.1)Saw the following in the trapsd.log when generating a support file. 2021/05/19T11:57:41.002-07:0...

Cortex XDR 7.1.1 reported as OLD defs after update from 7.0.1.

Hello all. We are using Global Protect with HIP rules turned on to enforce valid AV, etc. After an update to 7.1.1, HIP was seeing our virus definitions were dated 1/1/1970 for at least a few hours. Had to reboot before GlobalProtect would see current definitions. Didn't have this problem with prior versions of Cortex XDR. Additionally, the H...

Cortex Components in plain english / non-secops terms

In a lot of conversations recently I've found that many, many people are confused by the names and functions of Cortex - especially given the rapid expansion of the platform. In this post I'm going to try to distill the basics of each product with as little jargon as I can and help people figure out which things they are and are not looking for ...

KPawlak by • L1 Bithead
  • 4821 Views
  • 1 replies
  • 2 Likes

XQL Query for CVE-2021-1675 exploitation attempts (printnightmare)

Hi Community I need some help in creating an XQL query for a BIOC which detects exploitation attempts for CVE-2021-1675 (printnightmare). So far I have the following two queries: 1. A query that detects incoming connections on port 445 dataset = xdr_data | filter event_type = NETWORK and event_sub_type = NETWORK_STREAM_ACCEPT and (action_local...

Remo by • L7 Applicator
  • 7448 Views
  • 5 replies
  • 0 Likes
  • 2587 Posts
  • 95 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks