This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4397 Views
  • 0 replies
  • 3 Likes

SHOW ALL ALERT

Greetings everyone. I'm having a problem with Cortex XDR. Low-level security events aren't appearing on the dashboard; only medium, high, and critical ones do. I'd like all alerts to appear on the dashboard. I only see low-level alerts when I go to the /alerts directory and receive them via email. Cortex XDR

I want to block certain certutil commands from being executed through the BIOC Rule

Unable to get it why the below BIOC rule can't be added into the restrictions policy. I was trying to write a BIOC rule for monitoring dropped files via certutil. : dataset = xdr_data | filter event_type = 2 and event_sub_type = ENUM.NETWORK_STREAM_CONNECT | filter actor_process_image_name = "certutil.exe" | filter ( os_actor_process_command_...

P.Madye by • L0 Member
  • 861 Views
  • 1 replies
  • 0 Likes

Cortex XDR blocking wps

Why is cortex xdr blocking wpscloudsvr.exe and wps.exe? In the artifacts there is also this: "kaccountsdk.dll". To me they all seem genuine, or am I missing something?Also the initial cmd is confusing:""C:\Users\a\AppData\Local\Kingsoft\WPS Office\12.2.0.22530\office6\wpscloudsvr.exe" /wpscloudlaunch /run_plugin /plugin_name=ktaskschdtool /plugi...

Experience with Enabling IP Restriction for Cortex XDR Console Access Message:

Hi, I’m planning to enable the IP restriction (Approved IP Ranges / Allowed Sessions) feature for Cortex XDR console access. I already know where the option is located, but I’d like to hear from others who have enabled it. What was your experience when setting it up? Did you face any challenges (for example, avoiding admin lockout)? What b...

OrkhanM by • L1 Bithead
  • 846 Views
  • 1 replies
  • 0 Likes

After the Cortex XDR agent is installed, there is a volume shadow copy issue on the endpoint.

The VSS service on the endpoint is configured with a startup type set to Automatic. VSS operates normally until the Cortex XDR agent is installed. However, after the agent is installed for the first time, VSS fails to stay active despite its automatic startup setting. When manually started, the service repeatedly disables and re-enables itself. ...

How to Block Mobile Phones (iPhone/Android) via USB Using Device Control

Hi everyone, I'm currently working on a Device Control policy in Cortex XDR and I need to block mobile phones (iPhones, Android devices, etc.) when they are connected via USB — similar to how USB drives and external disks can be blocked. I understand that Cortex XDR uses ClassGuid to identify device types (https://docs-cortex.paloaltonetworks....

Cortext Modifying App Java Threads Without Warning

Cortex is currently messing with a java app at a customer site. We have a tomcat-based java app that we take to market. Cortex is currently messing with it. Cortex on, our app has issues. Cortex off, our app runs fine. Copy the entire folder and run on a different box without Cortex, the app runs fine. Major problem is Cortex is not throwing...

dvs2025 by • L0 Member
  • 906 Views
  • 1 replies
  • 0 Likes

Cortex Prevention Profiles

Hi Team, Customers found a few of the security modules disabled by default and they wish to enable the modules.- Below are the modules that the customer wishes to enable for the endpoints.“Agent Certificates”, “Data Generation Providers”, “PowerShell Script Files”, “On-Write File Examination”, and "VB Script modules".- We have provided the custo...

H.Patri by • L1 Bithead
  • 627 Views
  • 1 replies
  • 0 Likes

Endpoint is isolated

Basically I have a laptop loan from a school for the fall term, I downloaded a game which was counter strike source which I owned to keep me busy during breaks. Cortex basically told me it was a “Virus” and then ended my internet connection, Now I can’t use the laptop for schoolwork. How do I fix this?

tacbig01 by • L0 Member
  • 913 Views
  • 1 replies
  • 0 Likes

Resolved! XQL Help - Any AI tools, query library?

Wondering if there are plans to help build queries? Something as simple as looking for a file called "testfile" requires the query with the below code: |preset = xdr_file|filter action_file_name contains "testfile" Another example that we are currently working on is a way to search for specific models of computers. As an example: "find all Latit...

J.Suter by • L2 Linker
  • 3410 Views
  • 4 replies
  • 1 Likes

XQL help to detect when a process is stop or killed and by whom

Hello community, I'm trying to create a XQL Query to detect whenever a user is stopping a particular service (via services.msc, cmd, powershell, WMI or any other way), but I can not do it. I need to detect the user that send the stop service command, or the user that is killing the process. Is it any way to make this query? This is the c...

jrlambea by • L0 Member
  • 1036 Views
  • 2 replies
  • 0 Likes

Resolved! Quarantined File Automatically Moved to Allow List from Block List after File Restore Action

Have an interesting behavior that I was curious if anyone could clarify or validate. We recently enabled quarantine through malware profile/policy for VB Scripts Examination a feature just recently added to Cortex XDR v8.9. As such a hash that was previously added to block list quarantined a .vbs file by sha256 and an end-user contacted us repor...

Create custom widget to display data from Jamf

Hi Everyone,I'm wondering if it's possible to fetch data from JamfPro MDM solution for example user_name, ip address and mac details and add it as a custom widget to the cortex dashboard. If this is possible kindly guide me on how to achieve this.#apiIntegration #scripting #cortex_xdr

H.Patri by • L1 Bithead
  • 692 Views
  • 2 replies
  • 0 Likes
  • 2610 Posts
  • 98 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks