Cortex XDR Discussions

Mobile Phone Device Restriction on MacOS

Hello all,

I am currently looking into creating a Device Restriction Policy in which I block a physical connection of a Mobile Phone to MacOS endpoint. Once blocked I would expect to receive an alert on the Device Policy Violation page. Is this poss

...

Red teaming tool detection by XDR

Can you confirm whether XDR can block "Brute Ratel C4" tool executing threats.

Resolved! Disappearing XDR Endpoints for iOS and Android

Hi There,

We've got the XDR Agent for mobile devices deployed in our environment for both Android and iOS.

I've noticed after some time these devices stop checking in with Cortex in the Endpoints dashboard.

The devices will first say 'disconnected'

...

Resolved! Cloud identity engine - Logs collection

Hi Community,

Good day!

We are unable to see the logs in the Cloud identity engine log viewers. if possible, Could you please suggest a way to get logs from the Directories?

Thanks in advance.

Cortex XDR Cloud Identity Cloud Identity Engine

...

Resolved! Cloud Identity engine - Application

Hi Community,

Good day!

In the cloud identity engine for an Azure directory, we have the option of application. In that application option its showing as Not Consented.

Could you please tell us why it shows like that and how to rectify the not

...

Showing Malware incident in the Dashboard

Hello, just want to showed the Malware incidents and the related-malware filename in the dashboard, what should i choose for the XQL.

thanks

no Cortex XDR integration in "security providers" in "security center" in Windows Server?

Palo Alto docs say this:

The Cortex XDR agent registers with the Windows Security Center as an official Antivirus (AV) software product. As a result, Windows shuts down Microsoft Defender on the endpoint automatically, except for endpoints that are

...

Download the freshly created xdr-distribution-file

Hello

I'm looking for an autmoatisation, where I'm able to download the freshly created xdr-distribution-file.
In my Playbook I've created following steps:

xdr-get-distribution-versions
xdr-create-distribution
xdr-get-distribution-url

Now, the last step

...

User details in XDR

Hi,

We can see user details are not getting captured in the XDR endpoints details, how does logged-in user details are captured?

Thanks

Resolved! Need help with XQL query to report deleted files

Dear Sir,

Please if anyone can help to advise the XQL query to create a custom report to capture the "File Delete" activities in one particular server?

I know we can create the same from Query Builder, but from Query Builder it will only return 10,00

...

Resolved! Cortex XDR 8.1 release

Hi,

I can see that Agent version 8.1 was released on 25 of June (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Agent-Releases/Cortex-XDR-Agent-Releases) but I can't see it available on my portal. Could you tell me what have I misse

...

Resolved! Cortex XDR Pro - Server installations - still running Windows Defender (not Firewall)

Hello dear community,

what is your expirience with running MsMpEng.exe on Windows Server OS, while using Cortex XDR?

In my case the Windows Clients don't run MsMpEng.exe while Cortex XDR is running, but the server do so.

What is the difference he

...

Resolved! Cortex XDR iOS Agent

Does anyone have any information on creating an App Configuration Policy in Intune to push the Distribution ID and Username to the iOS XDR Agent on an iPhone/iPad?

Resolved! Agent Version - 8.1

Hi All,

Has the agent version 8.1 been released? as per the documentation it was released on June 25th but I am unable to see it on the console.

Thanks

Alert for internet down on site x (disconnected state)