Cortex XDR Discussions

Legacy Agent Exception

Hello, 

I have a file and when I run it, Cortex XDR blocks it and shows me some information:
"""

Application information:
Application name:  Windows Explorer
Application version:  10.0.22621.3007
Application publisher:  Microsoft Corporation
Process ID:  

Update hostname VDI Golden Image

Hi ,

we need change hostname on Golden Image VDI , it's necessary reinstall agent  Cortex XDR or exist some command to update this?

XQL use to or operator in the Regextract

Hi

I want to use or operator in XQL regextraxt but the following command does not work. Can you help us.
Thank you.

|alter etki=regextract(message ,"Etki\sAlanı\sAdı\:\s+([^\n\r]+) | Domain\sName\:\s+([^\n\r]+)")

Cortex XDR_ Device Control Violation_ Policy Management

Hello All,

Whenever the user is connecting any device in the system which is not allowed, we get the logs in the device control violation regarding that device.

In such case, what changes are required-

a) Allow the device through device permanent

Secshow.net

Hi All,

can you help for information i need

attach the picture.

what are the meaning thread id tunneling:secshow.net ?

thanks

Where to publish EDL

Hi,

I was planning to use Cortex XDR as my EDL publisher but since it doesn't support networks, only single IP addresses, it is useless for me. I don't want to publish it on our IIS servers so I'm looking for good alternative. Can anybody suggest som

how I add exclusion based on for an specific process (license.exe) for specific endpoint

Hi family 

How I add an  exclusion based on for a specific process allow  (license.exe) for specific endpoint on cortex xdr. wildfire are blocking this process many times so i want to allow for this service for specific endpoint. 

thanks, and regards.

is there a way to pass the password to cytool via cmd?

let say I want to run protect disable on 100 computers....  I tried the following but didn't work:

C:\PSTools>psexec -i -d -s \\pc100 cmd /c echo 5Nstall22#| "c:\program files\Palo Alto Networks\Traps\cytool.exe" protect disable

5Nstalll22# is the pas