Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.
anyone know if is possible to run script on Cortex XDR and force windows update installation on machines?
Hi Community,
I have a query regarding XQL. I have a list of over 100 approved application names available. How can I easily find the unapproved applications installed on machines, compared to the approved application versions?
I am writing to inquire about the procedure for modifying the severity levels of BIOCs (Behavioral Indicators of Compromise) within the Analytics module of Cortex XDR. Specifically, we are looking to understand how to create or adjust a custom rule w
...
Hi,
I’ve read in https://isacala.org/wp-content/uploads/2020/08/Cortex-XDR-Whitepaper_Coalfire.pdf that the PCI-DSS compliance with 10.5.5 and 11.5 can be achieved with BIOC rules. Unfortunately, there is no details. Has anybody done this and can s
...
How does the security feature Allowed Sessions works via approved domains? Does it just reverse lookup the source IP?
BR
Dennis
So, as the subject suggests, my colleagues and I are working on a method to uninstall the Cortex XDR agent from of number of computers (Macs). We do utilize the JAMF MDM here and hence why we are working on a script, however I cannot help but to thin
...
Hello,
I want to make some reporting and dashboard with the data provided from the agent vulnerabilty Scan.
I would like to obtain the following informations:
Hi team
We are trying to see if XDR agent logged any failed DNS queries... Basically a DNS query made on non-existing domain names.
Can't seem to be able to pull this info out.
Thanks
Hello,
I have successfully implemented Single Sign-On (SSO) for Cortex XDR using Azure SSO. Now, I am looking to disable the Customer Support Portal (CSP) login for non-admin accounts. The goal is to ensure that only admin users have the ability to a
...
Hello, I have successfully implemented Single Sign-On (SSO) for Cortex XDR using Azure SSO. Now, I am looking to disable the Customer Support Portal (CSP) login for non-admin accounts. The goal is to ensure that only admin users have the ability to a
...
I think that now is the time Palo Alto to release CrowdStrike to XDR migration guide or/and tool.
Does anyone know how to uninstall an application from a users profile via live terminal on cortex XDR. The user has a windows 10 enterprise computer but its installed on their profile. I am trying to uninstall a software called "Screen Share" (publis
...
Is authentication bypass required or not required when user authentication is performed?
Hello everyone,
Just curious who uses the Directory Sync tool out there? If you use it would you mind sharing a quick like/dislike about it? I really want to incorporate it into our environment but not entirely sold on it... yet. Any feedback about it
...
Hey guys,
I am curious about if there is a way to find out which Endpoints in certain environment do not yet have XDR Agent installed.
I still two options, but had no practical experience in testing it:
1. Directory Sync with Cortex XDR. Would it dete
...| Subject | Likes |
|---|---|
| 3 Likes | |
| 2 Likes | |
| 2 Likes | |
| 1 Like | |
| 1 Like |
