This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4547 Views
  • 0 replies
  • 3 Likes

Cortex XDR Integration with NGFW

Hello, I have Cortex Pro per GB license and NGFW. I have successfully created certificate and it is showing as valid in XDR console. I have created a profile which is sending logs to Data Lake. I have applied it on many policies. But I cannot get NGFW logs in Cortex XDR. This is my log forwarding profile: I suspect that it can be because ...

JahidAliyev_0-1732795917715.png
JahidAliyev_1-1732796032373.png
JahidAliyev_2-1732796049357.png

Prevention Policy Rules Time to update?

Hey, I've configured a Prevention Policy Rules to apply on windows endpoints which have a tag = myname.How long should it take to apply on these endpoints ?For example if I go to "All endpoints" in the "Assigned Prevention Policy" I still see the old policy name applied . How can I check locally on the endpoints which policy applied ? is there...

Creating disable prevention rule for Alerts with different sha256 but all other values were same

We have created a disable prevention rule for a few Cortex XDR agent-blocked alerts because they were false-positive. However, we recently received 2 new alerts with the same fields as the ones for which we created the disable prevention rule. I only observed that the sha256 value is different for the new alerts. So is it because of the differen...

Cortex XDR Ransomware Protection - Protection Mode "Aggressive" vs "Normal"

Hello Is there the cheat sheet of comparison of Ransomware Protection Mode "Aggressive mode" vs "Normal". I have no idea key differences between "Aggressive" and "Normal" mode. I need to that cheat sheet in my report. Anybody can provide or Do Palo Alto officially provided that cheat sheet. Where could I access? Thank you. Cortex XDR

Alert to Incident

Hey dear community, do I have the chance to elevate a alert to an incident? I tried allready to set the severity of an alert to critical, but nothing happened. This alert doesn't get an Incident ID. I thought this was possible in the past, but I can't remember if I am doing it right. BR Rob

RFeyertag by • L4 Transporter
  • 7695 Views
  • 7 replies
  • 0 Likes

Cortex XDR does not show file name

Hello everyone, I have an incident and when I open related logs, it is showing large upload. I can see a bunch of logs which indicates that someone has uploaded 53 mb file to amazon or one drive. I saw destionation host as ........amazon.com and initiatior path as ...../msedge. Unfortunately I could not see the file name itself. What can be r...

Resolved! How to download Cortex XDR 7.9 CE Version?

I want to install Cortex XDR on Win 7 and Win 8 systems and as per my knowledge we can only install 7.9 CE version agent. From where can I download it? its not showing in on Agent Installations --> Create agent installation option. Need urgent help here.

XQL Query to find bugcheck (BSOD) entries in event logs

We are experiencing a few BSOD events when auto-upgrade pushes new agents.Anecdotally, it only seems to happen to a small number of machines and well below 1% of the total XDR estate, however this is anecdotal and I keep getting challenged that "only IT people would report it"I need to go an investigate how many BSOD events happened in a partic...

ITDR Honey Users for Cloud Identities

Hi Everyone We're using ITDR module and are manually assigning asset role as described here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Asset-Roles Only on-premises identities from AD can be assigned to asset roles. The cloud identities from Entra-ID are not available and therefore can't be assigned. Both ...

Rocky-25 by • L2 Linker
  • 1652 Views
  • 3 replies
  • 0 Likes

SynRpcServer.exe in System32 folder

Hi,I got an alert "Globally rare process execution from a signed process" and after investigating the process is SynRpcServer.exe which not uncommon and also the host uses a fingerprint sensor so it should all make sense. But the interesting parts are on the causality chain are: SynRpcServer.exe executed "SynRpcServer.exe". The acting proces...

Panagiss by • L1 Bithead
  • 1430 Views
  • 2 replies
  • 0 Likes

Growth of ARM processors in Windows Ecosystem

With the continual growth and development of ARM in the windows sector there is a clear demand for a Cortex XDR Agent for Windows on ARM. This also impacts virtualisation on Macs and other devices with ARM processors.Is there an roadmap for consideration for this moving forwards?

Laptops dynamic group

I am looking for an efficient way to create a dynamic group for laptops only in the XDR console. So far, my only idea is to add a laptop tag during installation and then group by the tag. Is there an automated way to have XDR report the portable platform as a property that I can filter by in the console? I know how to identify laptops using XQL,...

maximk by • L2 Linker
  • 1051 Views
  • 1 replies
  • 0 Likes

Resolved! BIOC Rules for OneDrive File Uploads | Exfiltration

Hello, I have encountered an issue where some users in my organization are uploading large files (around 100 GB) to their personal OneDrive accounts using public Microsoft domains. Currently, Cortex is allowing these actions without signaling them. To address this, I created my own BIOC rules, which are functioning well : preset = network...

  • 2657 Posts
  • 101 Subscriptions
Top Solution Authors
View All
Latest Comments
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks