Hi Everyone,
Is it possible to setup email notification for critical and high incidents triggered in the Cortex XDR ?
I am using Cortex XDR Pro Per Endpoint (version V3.8)
Thanks in advance.
Hi, can you answer to this question?
If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance. Palo Alto Networks will provide the customer with a free instance. What size is this free Cortex Data Lake instance?
a. 1
...
Hello dear community,
can you describe the difference between 2 broker vms set up at one agent and a broker vm cluster?
Why should we take a cluster and do not set 2 broker vms at one agent?
BR
Rob
Hi all,
I'm new to Cortex and creating XQL queries. I was looking for a way to detect a brute force attack (failed logins followed by a successful login). Are there any good resources available online or can someone help me get this query built?
Th
...
Hey All, has anyone had to ever "set" a default language for the agent interface for a select group of users?
Ideally, I would like to flip all endpoints from a specific location to French.
If this is NOT possible, is there a way to set the lan
...
dataset = msft_o365_dlp_raw
How brake the raw log what is shot cut do that i have seen in you tube but im unable find how they doing that
Hello,
I am sending Cisco Asa logs to Cortex XDR and XDR automatically creates parsing rule of "Ingest". When I am searching for "cisco_asa_rules" in query, I got a field named "raw" which contains detailed format of log:
That is a detailed for
...
Hey community,
I'm curious if anyone's had experience with integrating AMSI with Sharepoint servers and how Cortex XDR works into all of that. I am curious also, if AMSI needs to be enabled or if it's recommended to be disabled. Any current configu
...
Hi,
I want to query a specific number of events between 2 dates.
I have this query below, but it is missing the "between current_date and last 5 minutes"
dataset = fortinet_fortiauthenticator_vm_raw | filter deviceSeverity != "information" | filt...
Hello, If I ask, can you please answer to this question?
The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to
...
I noticed that Cortex XDR 3.9 includes something called a "UEFI protection module". Here is the description from the release notes:
"Cortex XDR has expanded its malware protection capabilities by adding the UEFI protection module, which reinforces
...
Hi Team,
Can someone please let us know the XDR and Broker VM architecture?
Regards,
SHahwaz
Hi all, I have an issue that started popping up with an agent installation - newly installed agents throw out a 307 error. the package is present on the xdr management console, and we are beneath the license limit.
What can be the issue here?
Hi, I need help, I have Cortex XDR policy to allow scans on the endpoint, however users are unable to start the scans, the option does not appear
I can only scan, with cmd as administrator (cytool scan start) , in the GUI I can't even do it as admini
...
