Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Resolved! XQL query for locked AD account

Dear LIVEcommunity,

 

I've been wondering about using XQL query to locate locked AD accounts. Been looking at the dataset "msft_azure_ad_raw" which contained Azure AD Authentication Logs and have no success so far. FYI, We also ingest data via Cloud

...

Kandji MDM

Hello everyone,

Over the last two months we are having constant issues with Cortex and Kandji playing nice together. Before that everything was working without any issue for at least half a year, if not longer.

What happens is the following: Kandji g

...

JosipS by L0 Member
  • 384 Views
  • 1 replies
  • 0 Likes

Question about XQL to make a BIOC

Hello,

 

I'm trying to make a BIOC to inform when a SSH conection is made in some critical assets, but I'm not able to do it in XQL, I have done it using the interface.

 

Network Connections AND Destination [ Remote port = 22 ] AND Host [ Host Name =

...

Resolved! Cortext XDR exclude alert functionality

Greetings,

on the alert page:
For the right-click / manage alert / exclude alert

what is the function of the "exclude alert"
is it based on the alert name ? host name ? process?

what are the way to look at all the previous "exclude alert" 
and how to undo

...

SHAIKHR by L0 Member
  • 566 Views
  • 2 replies
  • 0 Likes
  • 1735 Posts
  • 78 Subscriptions
Top Solution Authors
Top Liked Authors