Can paloalto network Cortex XDR endpoint protection replace antivirus?

Authentication BIOC rule

Currently, I can create one-off or scheduled queries for authentication data / events but not BIOC rules which isn't ideal because scheduled queries don't create incidents.

Is it on the roadmap to add this ability?

Thanks.

Timeframes for BIOC rules

It'd be very useful for things like failed logons or network connection attempts if BIOC rules could utilise timeframes.

Is this on the roadmap?

It could work well if this was done in a similar way to NGFW → OBJECTS → Custom Objects → Vulnerability →

Demisto : How to display List of Messages

Hi Team, I am using create_incident API to create incidents. Below is the sample code. I can create an incident when I use "messages" as String.  Basically, this is custom_fields and its data vary from incident to incident.  Some incidents may have 

'Kernel Privilege Escalation' generated by XDR Agent detected on host xyz involving user xyz

Hi All

We are receiving large number of alerts in our cortex xdr console, The alert is as below, (hostname and user name I have kept as XYZ for privacy)

'Kernel Privilege Escalation' generated by XDR Agent detected on host XYZ involving user XYZ"

In

.zip files Cortex XDR PRO

Hi community,

Can cortex detect and analyze .zip files with password and delivered via email?

Mitre ATT&CK techniques missing

After reading https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-release-notes/release-information/features-introduced/features-introduced-in-2020.html#ide2559432-5eb3-4f83-8e85-c4159aeed9ed → "MITRE Tags Enhancements", I retroactively ad

Send Mitre ATT&CK information via Syslog

Hello Friends,

Does anyone knows how can we send the Mitre ATT&CK information/reference from Cortex XDR Alerts via Syslog?

The default configuration does not have this reference.

XDR agent install rolls back

Hi all,

 Has anyone ever had it where an agent will lose connectivity with the management console and will not reinstall afterwards? 

 I have an endpoint that lost connectivity with the console. Would not check back in. I removed it via the Control P

Web filtering in Cortex?

Hello,

We have just recently implemented Cortex XDR for endpoint protection and have a question about web filtering.  Are there profiles/polices in Cortex XDR that can enable any web filtering features or is web filtering strictly a firewall feature?

Client groups in Cortex XDR

Hello,

We are an existing Palo customer and we are moving to Cortex XDR for our Antivirus solution. In our current AV application we have groups for different clients based on exceptions or application for various reasons. It is very easy to create i

What the different of alert sources and definition of its.

XDR Analytics BIOC
XDR BIOC
PAN NGFW
XDR IOC
XDR Analytics
XDR Managed Threat Hunting
XDR Agent

Unable to upgrade Traps from 5.0.x to XDR 7.2

Hi Community,

I am unable to upgrade the Traps agent from v5.0.x to 7.2 using the rule from XDR console. I have upgraded from 6.0. Not sure whether my antivirus is blocking it.

I can see the version is showing as upgraded in the console for a while th