Cortex XDR API get_endpoints vs get_endpoint

Hello,

I've been using python script to get all endpoints /public_api/v1/endpoints/get_endpoints

(https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Endpoints).

Recently there was another business requirement to get OS type of

Cortex Xdr o365 compliance email

hi

 we integrated o365 API with cortex we have concern 

what it will do it will do anything?

what is the use compliance mail it block spam or malicious attachment 

Report XQL Bitlocker

Hello,

I created a report to display computers with Bitlocker that is not compliant :

Parsing at Broker VM level

I'm using COLLECT parsing rule to manipulate data at broker VM level before ingestion

 Rule basically filters out on raw log that I generate specific to my test like some log line that contains text criticalevent along with some date and random machi

Block APP

Dear,

I want to block an application, I configured it to block by the process, but when changing the name of the executable it also changes the name of the service as shown in the images. Would I be able to block it by the name that appears in the

Future of Cortex XDR

Hello dear community, 

we all now the future of SOC is Cortex XSIAM. 

What will happen to Cortex XDR in the future? I didn't see any planned new KI implementations into XDR. 

If you have more informations, please let me know.

BR

Rob

Looking for a XQL query to extract the systems enabled with WSL components

Hi All,

I am looking for a XQL query to extract the number of machines that have WSL components installed? Does anyone had a similar requirements in the past.

Long Malware Scan time, normal?

hello all experts, 

I have encountered a long scanning time,  i launched a malware scan from console to isolated endpoint, the job was created at 15:30 and finished by 05:30 by next day.

Guessing when the job was created, either the agent was dis

Do Bioc rules contribute to an Incident?

Hi

I wanted to understand how do BIOC rules contribute towards an incidence, I have seen ABIOC contributing towards an incident

Cortex XDR trap agent unable to connect the console

Hello! 
I got into a trouble with linux oracle and redhat, the trap agent was installed successfully, the agent is activate, broker_vm defined as proxy and it connected, in the console the endpoints were visible (even in the endpoint description also