This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4322 Views
  • 0 replies
  • 3 Likes

Resolved! Best way to detect endpoints that do not yet have Cortex XDR Agent installed

Hey guys, I am curious about if there is a way to find out which Endpoints in certain environment do not yet have XDR Agent installed.I still two options, but had no practical experience in testing it: 1. Directory Sync with Cortex XDR. Would it detect endpoints (which are in AD) that do not have XDR Agent yet installed?2. Pathfinder. Would Path...

DKasabji by • L2 Linker
  • 17632 Views
  • 17 replies
  • 1 Likes

Creating a stacked bar chart using XQL

I am creating a stacked bar chart that shows the number of alerts per data source per day.Is it possible to display the data source in the displayed graph? The stacked bar I created shows the time.※Whatever I select for the X-axis will be displayed in a stacked graph. A reference image is attached. Cortex XDR

XQL query for vulnerability

Hi. i need to do monthly report for vulnerabilities. So how to create like a trend report for 30 days here is just example for get count, but how to do trend report? dataset = va_cves | filter severity >Medium| filter affected_hosts_count >1| fields name, affected_products, severity| comp count() by severity

T.Nurmi by • L2 Linker
  • 1436 Views
  • 2 replies
  • 0 Likes

how to uninstall a package using rescue mode in Debian

my debian server crushed, wa are unable to acces the server(VM on OVH baremetal) using ssh(hard disc), we can usig rescue mode using the root user. after investigation we found that, it is a network problem due to Cortex, now my question is is there a way please using the rescue mode to unsitall coretx from the VM ? I have tried : dpkg -l | grep...

Resolved! Initiate Script on Endpoint via API call

Hi Everyone, I've been running Powershell scripts on my endpoints from Action Center > Run Endpoint Script > Execute Commands in the XDR interface. It works well, however I need to specify a manual query to target the endpoints I want each time i.e. within a specific IP Range, 'Connected' vs 'Disconnected' etc. It gets cumbersome when ha...

Cortex Screen Shot.jpg

Malware Scans on Linux Endpoints

Hi Team,Can you please confirm we can run malware scans on linux servers and linux virtual appliances? We want to create a policy in XDR to run periodic malware scans on the servers (Specially linux servers and linux virtual appliances). Regards,Saksham Khurana

Cortex XDR blocks MalwareBytes

After a recent update to MalwareBytes Cortex XDR is now detecting and blocking it. Has anyone else seen this, and is there a was to allow the MalwareBytes Digital Signature? I prefer not to have to allow the hash for each version.

GaryM_0-1739887323265.png
GaryM by • L0 Member
  • 801 Views
  • 1 replies
  • 0 Likes

Resolved! XQL query for all datasets

What's the fastest way to get a list of all data types by product and vendor across all data sets? I am looking for a way to query internal logs of XDR to get a list of all types of logs that are getting ingested into the XDR instead of using wildcard for the dataset keyword (E.g: dataset = * ). It is a resource intensive search.

XQL/BIOC - web

Hello, Can you tell me in which dataset I can find the following data? URL addresses User Agent With this information, can we create a rule that is based on defined values ​​and then generate an alert based on it or block it within the Restriction Profiles?Can someone share such a query or rule.

arekf by • L1 Bithead
  • 792 Views
  • 2 replies
  • 0 Likes

Cannot update user role to another user

This is about user permssion settings, I'm already the account admin of the XDR tenant already.Currently, the user scope is set to all, i want to change the scope for specific user.But there is no update user permission when right click on user does anyone share the same experience? Cortex XDR

XQL Timeseries Chart

I'm trying to build a timeseries chart that counts alert volume per day and that fills in zero values for days with no data. I have the following XQL that populates days with data but I'm unable to fill in a zero for all other days between now and the last event. dataset = alerts | bin _time span = 1D timeshift = 1736879866 timezone = "America...

  • 2589 Posts
  • 95 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks