Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Unable to parse the time stamp

I have trying to create a new field with existing string field (cretedDate) which is already in a ISO 8601 format but. unable to parse itsample value of feild createdDate=2019-08-29T10:10:26.608Z here below the query i have used | alter filedate = parse_timestamp("%Y-%m-%dT%H:%M:%S.%fZ", createdDate)Anybody help me to sort this out Cortex...

Cloud Identity Engine: New Agent Version Alert

Hi Team, We have installed two Cloud Identity Engines in two different domains. Currently, we are seeing an alert on the Palo Alto hub page regarding the availability of a new agent version for the Cloud Identity Engine. We have a question: will the agent upgrade automatically, or do we need to manually uninstall the old agent and install the ...

Netskope and Mimecast Integration To XDR

Anyone done the mimecast and Netskope log integration to Cortex XDR. Unable to find document for integration.Please share any doc or integration methods.

Malicious Hash detected as Adminstrative Hash exception

Hi Team, On analysing an ransomware incident, i have block the hash of malicious file and added the file path of malicious file into IOCs. However i can see the alerts for malicious hash in the Critical alert (IOCs based) and Low alert - Administrative Hash Exception. I have check allow list of IOCs and global exeception, but there was no ex...

Veeam Server high CPU Cortex XDR

Hello, We have a server with Veeam Backup, and we are noticing high CPU usage from Cortex. We have seen that some exceptions might need to be applied: https://www.veeam.com/kb1999 Would this apply to Cortex? Best regards.

Resolved! Finding if a URL was visited using XQL in Cortex

We wanted to see if we could use XQL to query for if a URL was visited in our environment. Is there a way to structure a working query for this using XQL? We've tried unsuccessfully so far, so we are turning to you, the community. Thank you for any assistance.

Cortex XDR Incidents

Hi Team, How can I create a BIOC rule for large upload activities of more than 1 GB of data in external storage? Please share your input.

Resolved! Detect delete agent with XQL.

I kindly ask for your assistance with an XDR XQL query language script to identify devices in the network that do not have the XDR agent installed. Additionally, it would be helpful if the users could be identified from AD or through the DHCP on the network."

Resolved! XQL For Silent Log Source

below is the query so far but what we are trying to do is get a silent log source detection. For example, one of the log source names has not sent a log in x number of hours then alert. Any suggestions?dataset = panw_ngfw_traffic_raw | fields log_source_name | dedup log_source_name

Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

Hi, Is it possible to obtain a custom widget like "Vulnerabilities On All Endpoints Over Time" via XQL? We would like to filter out some endpoint Is there a dataset with detailed history information? Thanks

Resolved! There is no alert severity in the SIEM logs.

Hi. We send Cortex XDR syslog to SIEM. When I check Notification (Settings - Configurations - Notifications) settings, Severity field is available. But on SIEM logs, there is not severity of alert.

Resolved! Azure AD and InTune

Hi Palo Live Community, I'm hoping that someone has worked with Cortex XDR and Azure InTune. I'm trying to find a dynamic way to apply an extension profile (block USB), in Cortex XDR, targeting specific endpoints that reside in Azure InTune. Before, I was using Active Directory OUs to target these endpoints but newer endpoints being added t...

Cortex XDR agent removal

Hi all, In one of our endpoints XDR agent triggerd an alert named ' Suspicious file modification detected ' cmd is 'C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}' after this XDR service cyserver was stopped , now status is disconnected, we don't have data to analyze the issue. what can i do

Cortex XDR to google chronicle

Dear community, One of my client is using Google chronicle as their SIEM . They would like to know and understand what is required on Palo-Alto Cortex XDR side to send their logs to Google Chronicle . Is there a simple way to do this ? Do we need a Broker VM ? Thanks Da

XDR 8.5.0 print servers error

Hi, we are experiencing issues with Cortex XDR agent version 8.5 on our PrintServerWe had agents running version 8.4.0 without any errors, but after upgrading to version 8.5, we started encountering printing problems on the servers.The error is:Faulting application name: spoolsv.exe, version: 10.0.20348.2520, time stamp: 0xf42f642eFaulting modul...