This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4323 Views
  • 0 replies
  • 3 Likes

XQL help AD

Hi everyone,Anyone know how to query what types of AD queries users run?I want to (1) find users/computers doing AD enumeration and (2) see what kind of enumeration they ran.

tlmarques by • L4 Transporter
  • 500 Views
  • 1 replies
  • 0 Likes

Cortex XDR: Removal on MacOS

Any resources on command-line/automated Cortex XDR removal (with key) for MacOS clients? We're a MSP/MSSP and have requirement often to bulk remove XDR when (e.g.) offboarding clients or during M&A activities, etc. I'd open a case at support but since *my* organization has not Cortex assets, I don't get that option. Does anybody have any r...

J.Winks by • L1 Bithead
  • 522 Views
  • 1 replies
  • 0 Likes

Request for File Path Information in Cortex XDR Vulnerability Assessment Data

I'm using the XDR API to retrieve vulnerability assessment data (specifically the va_cves and va_endpoints datasets) provided by Host Insights. I would like to know if the API—or any other Cortex API—can provide the file path information associated with each vulnerability on an endpoint. Specifically Is there an endpoint in any of the Cortex ...

False Positive Issue - Multiple Windows System Processes Flagged by Cortex XDR

Hello everyone, I'm experiencing ongoing false positive alerts with Cortex XDR that are affecting multiple endpoints in our environment. I'm seeking guidance on how to properly address this issue. Environment Information: Cortex XDR Agent Version: 8.6.0.3704 Operating System: Windows 10 64-bit Issue Scope: All endpoints in the environment Prob...

2025-08-07_150647.jpg
2025-08-07_150548.jpg
2025-08-07_150235.jpg

Resolved! Vulnerability Management Cortex XDR (first detection date/time)

Hello, I want to make some reporting and dashboard with the data provided from the agent vulnerabilty Scan. I would like to obtain the following informations: How long has a CVE been present on a machine? How much time elapses between the appearance of a CVE and its disappearance (Hope is due to patching)on a machine? I find nothing in the tem...

MathB12 by • L0 Member
  • 1966 Views
  • 3 replies
  • 1 Likes

All Asset Total Number-Cortext XDR

Hello, I have added 5 endpoints to Cortex XDR. On the All Assets page, I can clearly see these 5 endpoints listed with their respective names and categorized as General Devices. However, I’m seeing over 200 additional assets that: Have no names Are categorized as Device Have a type listed as Generic Device I did not add these assets manu...

PaloAltorrr_0-1754393483740.png

Log delete block

Hi everyone, There is a problem we facing with. We created BIOC rule for this action but we cannot prevent it. Is there any way to block this action via XDR? thanks

OrkhanM by • L1 Bithead
  • 580 Views
  • 2 replies
  • 0 Likes

Verify default policy and custom on Cortex XDR

Dear Support,I would like to open case for verify and confirm on these tasks below: + Currently we use this default rule on Cortex Prevention Policy Rules for customer that just enable it as protection mode but customer concern it’s not best practice recommendation and requested us to review all those settings again. + IOC Rules – Ensure indicat...

CChan50 by • L0 Member
  • 733 Views
  • 1 replies
  • 0 Likes

Alert Not Stitching (Custom Correlation Rule)

Hello everyone, I have a question about alert stitching in Cortex XSIAM/XDR. I created two correlation rules: Policy - Violation Root Detection (Medium severity) Policy - Successful Sudo Command (Low severity) However, when I check the incidents, the alerts are not being stitched together. I believe they should be stitched because the user...

G.Anshar by • L1 Bithead
  • 1226 Views
  • 3 replies
  • 0 Likes
  • 2590 Posts
  • 97 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks