Wildfire Report verdict as Incorrect consolidated report

Hi All,
When we upload files to Wildfire revalidation, it notifies the verdict change via mail that we provided while submission. Is there any way to get consolidated report in Cortex XDR to track how many Hash values we submitted for revalidation and

Alerts and incidents

Hello Palo Live Community.
Does anyone know what are the criteria that Cortex XDR takes into account to create an incident for a single alert? This is because I have seen that some alerts do not necessarily form an incident, but in other cases, yes. I

ITDR Honey Users for Cloud Identities

Hi Everyone

We're using ITDR module and are manually assigning asset role as described here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Asset-Roles

Only on-premises identities from AD can be assigned to asset r

XQL query for incident report

I like to get a hint how i can build simple xql query for  overtime timeframe for incidents. I need to filter that data, but that kind report that i can show example monthly base report for customer. where there are data for each day

XQL Query Help

XQL Query Help

XQL Query Help

I'm trying to write a few XQL queries in Cortex XDR, but I’m quite new to it and running into some difficulties. I’d really appreciate any guidance or examples you can provide for any of the following queries:

1. To detect when the Cortex XDR Agent is u

Cortex XDR agent on Domain Controller

Dear all,

May I have a chance to find with you palo guidelines regarding Cortex XDR agent installation on Domain Controller.

Any comments ?

Growth of ARM processors in Windows Ecosystem

With the continual growth and development of ARM in the windows sector there is a clear demand for a Cortex XDR Agent for Windows on ARM. This also impacts virtualisation on Macs and other devices with ARM processors.

Is there an roadmap for considera

high priority 'Behavioral Threat' alert for smss.exe (system)?

Every few weeks or so getting a high priority alert: