ingested data retention - 30 days

Hi guys,

I've purchased PAN-XDR-PRO-GB SKU and i've noticed we get 30 days of ingested data retention and 180 days of incident or alert retention.

Can we keep ingested data for more than 30 days? and/or incident alert retention for more than 180

Local Malware Analysis

Hello,

Could we know the frequency with which the hosts are scanned to identify alerts in local malware analysis module? 

How can I see Agent Script Library on Cortex XDR

I would like to have the option for the Agent Script Library on my dashboard. Is it possible that higher privileges are required to access it?

some of endpoints might be exposed to risk due to report-only policies

Dear Team,

While login my Organizational XDR Console, their is attention message display - Image added. 

If you guys having answer Please share to me - Thanks 

Using XDR Asset Inventory and XQL to report of machines without Cortex installed

Hello All

I would like to use Asset Inventory to provide a list of each machine with os Windows and without Cortex agent installed.

The goal is to use the result in a widget for the dashboard if possible. Even better would be an api to use it with

USB Drives Are Blocked - Want to Enable for Certain Endpoints

Hello,

We are very new to having XDR and our onboarding was not very well done. They ended up doing everything on their own and struggling with it all; having mulitple people on the call to show our onboarder how to do things, etc... It was not ver

Cortex XDR XQL Query

Cortex XDR Pro - 8.2.0.46438 - Agents Disconnected - service state "stopping" how to monitor that?

Hello dear community, 

today I ran into some issues with the version mentioned above. I know it got hotfixed, but when you cannot install an upgrade and cannot uninstall the agent, I get challanged 

You need to uninstall it directly after restart,

Cortex XDR VM Broker Cluster and External Load Balancer

Hi All, 

I have 3 Broker VMs deployed in my Google Cloud project and I want to create a cluster from them. I also want to put a load balancer in front of the cluster as mentioned in the documentation "For "active/active" applets that require load b

Querying BitLocker status on a certain endpoint

I am aware of "Disk Encryption Visibility" where we can see the encryption status all volumes under any endpoints. But it appears we can't filter on this field (Volumes Status).

Is there any way at all to programmatically answer a simple question l

Need to prevent malicious files while downloading, Pre-execution preventing

How to prevent or block malicious files while downloading from internet in cortex XDR. cortex xdr will only block a malicious file when it will execute but I want to block a malicious files before the execution similar to windows defender which can d

Denied URL - Broker VM

Hi team!

Does anyone have or have had a situation where the applet local agent settings show "Denied url: URL_HERE"? 

 Sometimes for short periods of time (around 5 -30 seconds) our broker VMs turn on in red the applet and we can see the message