This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

 

Rules and Best Practices

 

  1. Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion
...

JayGolf by • Community Team Member
  • 1873 Views
  • 0 replies
  • 3 Likes

Role based privilege's

Dear Team,

As per the client requirement, Kindly suggest for the role based privilege's that can be assigned L1 and L2 users accordingly.

where L1 is lower level engineer and L2 is above L1.

Powershell problem

Hi forum,

I have a problem with PowerShell, specifically with the file located at C:\Program Files\Winget-AutoUpdate\winget-upgrade.ps1.

When I restart the computer, Cortex send alert appears regarding winget-upgrade.ps1.

I created a disable preventi

...

Resolved! Endpoints with Public IP

Hi All, looking for some help here on creating an XQL query to search for any endpoints that are assigned public IP addresses. I searched and didn't see anything in the Live Community that already speaks to this. 

I appreciate any support you can prov

...

Cortex XDR AWS Marketplace

Hey,
I've recently purchased Cortex XDR via the AWS Marketplace - I haven't gotten an email or indication that my Cortex XDR instance has been created or what it's status is.

Would love some help with this!
Thanks,
Itai

Resolved! Dump alert data Analysis

Does anyone know how we can and how we should analyze a dump file when we do a retrieve alert data on Cortex XDR #

I've alerts related with memory dump, normally initiator is excel, and 99% i think the cause is excel crash or file have macros/vba ins

...

tlmarques by • L4 Transporter
  • 1017 Views
  • 1 replies
  • 0 Likes

Unauthorized - 4010402

Hi Community,

Has anyone encountered the "Unauthorized - 4010402" error when trying to log into their tenant account? I attempted to log in, but I received this message. Does anyone know what could be causing this issue or how to resolve it?



Thanks i

...

userLoginName_0-1741586157475.png
Y.Zalsov by • L1 Bithead
  • 1420 Views
  • 3 replies
  • 1 Likes

Resolved! Cleanup endpoint and CVE List

Hi,
I need your help to understand if there is an option on Cortex XDR to periodically clean up the endpoint list (for lost connections) and remove any vulnerabilities associated with those endpoints.

tlmarques by • L4 Transporter
  • 868 Views
  • 1 replies
  • 0 Likes

Resolved! XDR agent quota exceeded

We were monitoring the XDR Agent Audit logs and found out a lot of agents have this alert Quota Exceeded: "XDR agent quota exceeded on ******."

Can anyone explain this? 

Cortex XDR Connection method

Hi, While monitoring network traffic during our deployment, we noticed that all traffic between the endpoint and the XDR portal (<xdr-tenant>.xdr.<region>.paloaltonetworks.com) is one-directional (outbound).

 

We have private Linux servers in a separ

...

XQL query for critical commands

Hi everyone.
I'm trying to create an XQL query for a BIOC that will trigger an alert when specific commands are run.
I've tried the "visudo" and "sudo -l" commands on two servers. On one it detects both commands and on the other it only detects the "vi

...

Clean up Tags list

Hello All,

I want to clean up my tags list, because some of the old tags that we used are not needed any more.

We don't have active devices with tags that I want to remove.

Any idea from where i can do that?

 

Regards,

Vasil

Resolved! Windows 11 security features

We are in the process of testing/implementing Windows 11 OS on endpoints and noticed upgraded security features that are available to toggle on. Some of these protection features are already within the cortex polices. 

 

If we toggled these features

...

KamalKishore_0-1740437562031.png
KamalKishore_1-1740437571171.png
  • 2483 Posts
  • 89 Subscriptions
Top Solution Authors
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2025 - Palo Alto Networks