Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

Hi, Is it possible to obtain a custom widget like "Vulnerabilities On All Endpoints Over Time" via XQL? We would like to filter out some endpoint Is there a dataset with detailed history information? Thanks

Cortex XDR agent removal

Hi all, In one of our endpoints XDR agent triggerd an alert named ' Suspicious file modification detected ' cmd is 'C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}' after this XDR service cyserver was stopped , now status is disconnected, we don't have data to analyze the issue. what can i do

Cortex XDR to google chronicle

Dear community, One of my client is using Google chronicle as their SIEM . They would like to know and understand what is required on Palo-Alto Cortex XDR side to send their logs to Google Chronicle . Is there a simple way to do this ? Do we need a Broker VM ? Thanks Da

XDR 8.5.0 print servers error

Hi, we are experiencing issues with Cortex XDR agent version 8.5 on our PrintServerWe had agents running version 8.4.0 without any errors, but after upgrading to version 8.5, we started encountering printing problems on the servers.The error is:Faulting application name: spoolsv.exe, version: 10.0.20348.2520, time stamp: 0xf42f642eFaulting modul...

Agent Configuration - Password strength

Hi, I'm struggelin' to set a new password. Have tried all kind of combinations. Allways get "Does not meet the requirements." Please see attached for an example.. I've seen earlier discussions on this. Something does not seem to be working as intended.. Regards Ivar

Cortex xdr with RedHat Quay with Clair

Hello PA community, For all images on customer s OpenShift clusters, they have a policy that all images have to be stored in their RedHat Quay with Clair. Customer has tried to setup a mirror with the "europe-west4-docker.pkg.dev/xdr-eu-2009645628112/agent-docker/cortex-agent" repo but unfortunately the only authentication possible in Quay is wi...

Wildfire Report verdict as Incorrect consolidated report

Hi All,When we upload files to Wildfire revalidation, it notifies the verdict change via mail that we provided while submission. Is there any way to get consolidated report in Cortex XDR to track how many Hash values we submitted for revalidation and corresponding wildfire result.

Alerts and incidents

Hello Palo Live Community.Does anyone know what are the criteria that Cortex XDR takes into account to create an incident for a single alert? This is because I have seen that some alerts do not necessarily form an incident, but in other cases, yes. I insist, talking only about a single alert.I attach evidence.

XQL Query Help

XQL Query Help

XQL Query Help

I'm trying to write a few XQL queries in Cortex XDR, but I’m quite new to it and running into some difficulties. I’d really appreciate any guidance or examples you can provide for any of the following queries: To detect when the Cortex XDR Agent is uninstalled, To trigger an alert for Tamper Detection, To monitor if a live terminal session is i...