Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Resolved! Periodic scan of shared folders

I have a question about "Periodic scan".

Is it possible to periodically scan a shared folder mounted as a network disk by a Windows Server OS virtual machine?

The purpose is to periodically scan multiple shared folders (SMB).

Resolved! XQL Query / Alert Help

I'm trying to create a query / correlation rule to notify me if a certain number of connection attempts have hit a certain IP witihn 'x' amount of time. For example,

dataset = panw_ngfw_traffic_raw
| filter (dest_ip contains """xxx.xxx.xxx.xxx""")

...

Ransomware isolation automation

Hi everyone.

Have XDR Pro. Looking for an "easy" way to automatically isolate a device when ransomware-like behaviors are detected. Looking through the automation configurations, it doesn't appear to be that easy. I obviously don't want to be isolati

...

Resolved! Sending Cortex XDR incidents to MS Teams

So, since XDR has only 3 options of forwarding alerts - email, syslog server and slack. There is no straight method to push alerts to MS Teams. We've found a bypass which is to create an email address for a teams channel and then provide that email a

...

Resolved! Notification via Mail - Improvement

Hello!

Changes are coming with 3.11, but for improvement put this information directly into mail:

Source
Category
Action
Host
Username
Starred Alert
Excluded Alert
Alert ID
Incident ID
actor_process_image_path
actor_process_image_name
actor_process_command

...

Disk space and usage

Hello,
If Agent settings are configured at the default 5000mb to allot for XDR agent logs.

How many days would this be expected to cover - ie are there any rough figures on low - high usage devices, to get an estimate.
Looking at dataset use I estimat

...

Cortex XDR Host-Based Firewall

Hi Team,

I have a query regarding Cortex XDR's host firewall. We have enabled the host firewall on one machine in reporting mode for testing purposes. The configuration was successful, and we received host firewall events. We collected the detailed

...

Resolved! 【Cortex XDR Pre/Pro EndPoint】Operation of Cortex XDR Agent

Could you please provide an explanation of the policy management and update management for Cortex XDR Agent?

Resolved! API Key Required Permissions for Set a User Role

Hi,

I try so many configurations but only the permissions 'Instance Administrator' for the API is working to "Set a User Role"

Set a User Role | Cortex XDR (stoplight.io)

What is the RBAC permissions to run this API "Set a User Role"??

Incident Reports - any hidden feature to crate an incident report summary?

Ist there any possiblity to create an incident report by just a click?

Something like this:

https://techsevenpartners.com/a-step-by-step-guide-to-creating-a-cyber-security-incident-report/#:~:text=To%20create%20a%20cybersecurity%20incident,%E2%80%9

...

Resolved! browsers extensions Alert

Hello dear community,

I would like to see more rules which are containing everything about browser extensions. Like in chrome, "browser extension was created".

I know to manage chrome via GPO, but there are not always Active Directories and I wo

...

Resolved! Updates missing force install via XDR

anyone know if is possible to run script on Cortex XDR and force windows update installation on machines?

Resolved! Cortex XDR XQL query

Hi Community,

I have a query regarding XQL. I have a list of over 100 approved application names available. How can I easily find the unapproved applications installed on machines, compared to the approved application versions?

Resolved! Cortex XDR Analytics BIOC Rules' Severity

I am writing to inquire about the procedure for modifying the severity levels of BIOCs (Behavioral Indicators of Compromise) within the Analytics module of Cortex XDR. Specifically, we are looking to understand how to create or adjust a custom rule w

...

Resolved! Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

Hi,

I’ve read in https://isacala.org/wp-content/uploads/2020/08/Cortex-XDR-Whitepaper_Coalfire.pdf that the PCI-DSS compliance with 10.5.5 and 11.5 can be achieved with BIOC rules. Unfortunately, there is no details. Has anybody done this and can s

...

User

Likes Count

8 Likes

4 Likes

2 Likes

1 Likes

Cortex XDR Discussions

Discussions