This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4322 Views
  • 0 replies
  • 3 Likes

Resolved! Cleanup endpoint and CVE List

Hi,I need your help to understand if there is an option on Cortex XDR to periodically clean up the endpoint list (for lost connections) and remove any vulnerabilities associated with those endpoints.

tlmarques by • L4 Transporter
  • 1108 Views
  • 1 replies
  • 0 Likes

Resolved! XDR agent quota exceeded

We were monitoring the XDR Agent Audit logs and found out a lot of agents have this alert Quota Exceeded: "XDR agent quota exceeded on ******."Can anyone explain this?

Cortex XDR Connection method

Hi, While monitoring network traffic during our deployment, we noticed that all traffic between the endpoint and the XDR portal (<xdr-tenant>.xdr.<region>.paloaltonetworks.com) is one-directional (outbound). We have private Linux servers in a separate environment with no internet access. However, after deploying the agent and revie...

XQL query for critical commands

Hi everyone.I'm trying to create an XQL query for a BIOC that will trigger an alert when specific commands are run.I've tried the "visudo" and "sudo -l" commands on two servers. On one it detects both commands and on the other it only detects the "visudo" command.The XQL query is as follows:dataset = xdr_data| filter event_type = ENUM.PROCESS an...

Clean up Tags list

Hello All, I want to clean up my tags list, because some of the old tags that we used are not needed any more. We don't have active devices with tags that I want to remove. Any idea from where i can do that? Regards, Vasil

Resolved! Windows 11 security features

We are in the process of testing/implementing Windows 11 OS on endpoints and noticed upgraded security features that are available to toggle on. Some of these protection features are already within the cortex polices. If we toggled these features on would any of them interfere with the Cortex agent or its protection polices? Windows 11 Pro...

KamalKishore_0-1740437562031.png
KamalKishore_1-1740437571171.png

Anti-tampering Protection

Hello, I got incident with Anti-tampering protection which was blocked, i reviewed the alert by CMD C:\WINDOWS\system32\svchost.exe -k GPSvcGroup it it false postive?any ideas? Cortex XDR

Security Channel Subscription Errors

Team, While trying to collect logs from windows, one channel that is consistently resulting in errors is security channel. Systems and Applications work just fine eliminating any possibility connectivity or authentication issues. It is the security channel that is causing issues and not sending logs to XDR. I know it is too broad a question. Giv...

Cortex XDR Query for USB/External Drive Usage

Hi Family Good morning. I am trying to filter the timeframe when a user last connected a USB flash drive or external hard drive using a Cortex XDR query. However, the following query did not return the expected results: dataset = xdr_data | filter event_type = device and event_sub_type = DEVICE_PLUG I would like to retrieve details ...

Issues with Mass Uninstallation of Cortex XDR Agents via SCCM

Cortex XDR sometimes have these stubborn machines that refuse to upgrade to the latest versions. what are ways you use to alleviate this issue? Mine is SCCM.I am trying to automate the mass uninstallation of older versions of Cortex XDR agents via SCCM on hundreds of Windows clients. The issue I’m encountering is related to password handling dur...

V.Wokili by • L0 Member
  • 2174 Views
  • 2 replies
  • 0 Likes

Resolved! XQL chart editor

Hi. just i'm little stuck... config timeframe = 1y|dataset= incidents|filter (status in (ENUM.RESOLVED_FALSE_POSITIVE,RESOLVED_AUTO_RESOLVE))|fields creation_time ,status|alter month = format_timestamp("%m",creation_time )|sort asc month|comp count(status ) as total_auto_resolved_inc_month by month,status| view graph type = column subtype = gr...

TNurmi_0-1740054064047.png
T.Nurmi by • L2 Linker
  • 1860 Views
  • 1 replies
  • 0 Likes
  • 2589 Posts
  • 95 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks