Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

I ingested the Checkpoint firewall logs into Cortex XDR, now what should I do?

Hi,

Some time ago I connected the CheckPoint Firewalls with Cortex XDR and I can now see the alerts from the Cortex console.

My question is, what should I do now with the alerts? Since the FW is generating more than 100 incidents a day.
I had crea

...

Cortex XDR Notify about Incidents via phone call

Hi,

is there a way to configure a robocall on Cortex XDR so that if a high or critical incident raises, I'll get an automated call to my phone notifying me about an incident? Maybe someone of y'all already have such configuration and would like to

...

How IOCs are detected?

Hi,

I've recently noticed that an IOC that we created a month ago is still somehow being triggered, therefore an incident is generated. The IOC is a domain that we've found in a phishing email. I haven't visited the domain or clicked on that quaran

...

Resolved! Select more than 100 endpoints in Prevention Policy Rule

Hi,

I created new Prevention Policy Rule and can only select 100 endpoints. When I try to select more, I get the Note:

Note: The current target will be based on 100 endpoints, you cannot choose more than 100 endpoints. To create a larger target use Dy

...

Cortex XDR Uninstall without password and active tenant

On Windows computer we have installed the cortex XDR agent on POC tenant.

The tenant was deleted but we don't uninstalled the agent on the client computer.

We try to uninstall it manually, but we don' have the password.

We try with the default password

...

Resolved! Cortex XDR Certificate enforcement for Windows and macOS endpoints

Hi Team,

I have a query regarding the Cortex XDR Agent (8.3) Certificate Enforcement settings.

1. Enable the Certificate Enforcement option.
2. Decrypt either only Cortex XDR Agent traffic in the firewall or decrypt all traffic related to application

...

Question About Custom Logs Time Field

Question

I want to replace _time field value with original timestamp, but I can not find way to do this.
Please tell me how to replace _time field value or Is this not possible due to specifications?

Background

When we collect logs from XDR Collector

...

Resolved! Cortex XDR Timeline to XQL

Hi,

For our SOC report, we want to have this table with the average statistics of last week's monitoring, including average time to assign, time to respond etc. Is there a way to extract these timestamps from the incident's timeline on XQL and ther

...

Bloodhound detection

Does anyone know what ways exist in Cortex XDR to detect if someone is running BloodHound?

Resolved! XQL insert group into active directory

Hi team,

Does anyone have xql that sends the log when I add a user to a group in the active directory?

PoorTry kernel-mode Windows driver Detection/Prevention using CortexXDR?

Wondering if we have any IOC, settings, content updates, to find and or inoculate against the PoorTry kernel-mode Windows driver. It's incredibly potent and resistant to defensive measures.

Latest article on it: PoorTry Windows driver evolves into

...

MOQ - Cortex XDR NFR

Hi team,

May I know, what is minimum quantity to purchase for Cortex XDR (Prevent and Pro) NFR?

Also, is Cortex XDR NFR quotation will consist only 1 line item, no need for any support SKU?

Thank you in advance!

Cortex Update

I have an issue when trying to update users to the latest version of cortex. The control panel shows that Cortex is not installed but the Cortex Icon shows up in the system tray and I can access the console from there. When I run the uninstall tool t

...

Resolved! Can't uninstall damaged installation of Cortex XDR

Hi all,

On one of our pc we can't uninstall the version 7.3.1.20981 of Cortex XDR.

When we try to uninstall the program appears the popup with the warning "Cortex XDR only supports per-machine installation" and the uninstall process fails.

Cortex X

...