This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4398 Views
  • 0 replies
  • 3 Likes

"Actions" in action centre are stuck at "In progress" only

Hi All, I have started facing an issue where whatever actions start via action centre, First it says "Pending" after that it turns to "In progress" status. and it stays there , It never shows status as "Completed successfully" Just to test, I initiated the scan on my own system and for more than 1hour status is "in progress" (Usually the scan fi...

AsifSid by • L2 Linker
  • 4942 Views
  • 1 replies
  • 0 Likes

Resolved! cortexuser in Linux Agent

Hi Community, Anybody has any information on the user 'cortexuser' created while installing cortex in Redhat Linux ?, What this user used for and which folders are owned by this user Thanks in advance

File server, backup server and storage server profiles

Hi, we are about to activate Cortex XDR agent with Default Policy Rules (i.e. Default Exploit, Malware, Restrictions, Agent settings and Exceptions profiles) on some Windows servers which contain a huge amount of data (terabytes). Are there some recommended best practices to follow or some functionalities that should be disabled in order to avoi...

MCereda by • L0 Member
  • 3730 Views
  • 2 replies
  • 0 Likes

Resolved! Cortex XDR - Detected (Scanned) alert for malware

Hello, Please excuse me if these are very basic questions. I have been trying to find a definitive, written answer and have been unable to, so far. If 1. Portable Executable and DLL Examination is set to the default of 'block' in an applied Cortex XDR policy, 2. a scan is run on an endpoint using that policy and 3. a malicious executable is ...

Resolved! Cortex XDR Windows Event Collector

Hello!I set up Windows Event Collector and data is coming to XDR. But i want to see data which come from Windows Event collector. In which category this data located? How can i search Windows Event collector data in XQL? THANKS!

XDR Global BIOC rules

Hello.If Restrictions profile for Windows is default then they don`t directly affect windows endpoints. We must edit and and apply them for getting protection in endpoints. But in Linux it is not same. Even if Restriction profile is default, XDR can generate alert base on global BIOC. I want to know why there are such difference? Thanks!

Cortex XDR Broker VM (proxy server)

Hello.In XDR Broker VM i enable proxy server and configure as follows:Type:HTTPAddress: 192.168.6.167Port: 8080 But it is not work and in configuration status i see "in progress" even through 3-4 hours.I want to know if is there anybody who configured this proxy successfully and how? Thanks!

Resolved! Uninstall agent rom MacOS

Hello, We want to uninstall an agent from MacOS, but we do not have the admin password. And we can't reset the password because the tenant was deleted it. So the agent does not have administration from web console. I try with "Passowrd1", it doesn't work. Does someone know how to uninstall it? I know that for Windows, there is a "special cleaner...

iscott by • L2 Linker
  • 7326 Views
  • 2 replies
  • 0 Likes

Resolved! Piloting XDR 7.3.1, policies seem more stringent- blocking previously allowed scripts and .exes

We are in the process of updating our endpoint XDR agents from 7.2 to 7.3.1. We are testing on a small pilot group and finding that scripts and executables that we previously ran are now being blocked. Granted some these scripts are stopping and starting services and removing files. We are concerned if we deploy it site-wide that we'll have m...

WORRELLR by • L0 Member
  • 3832 Views
  • 3 replies
  • 0 Likes

Cortex XDR Windows Event Collector

Hello!My question is about Windows Event Collector.Why we need Windows Event Collector? Don't XDR Agents collects all needed information from Windows endpoints? Can Windows Event Collector give us useful information than Agents?

Cortex XDR files modified

We have some systems that are locked-down with software that prevents modifications to files/directories, and I'm wondering what are the paths that Cortex needs to be able to modify? For example, when it downloads the latest definitions, what does it need to modify? Is there any data stored in the registry as well?

  • 2611 Posts
  • 98 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks