Cortex XDR Discussions

Resolved! Cortex XDR along side MS Defender for Endpoint

Hi

We are in a position where we would want MS Defender for Endpoint (the EDR, not just the AV) to fully work alongside Cortex XDR.

We dialed Cortex XDR's protection down to work "passively" by re-configuring all modules to the "report only" as o

Resolved! ARM support for Cortex XDR

Hello,

as more and more sytems are using ARM architechture, is there any update for the ARM support release for XDR agent by palo alto or Beta-program?

Thanks

Resolved! Broker VM and direct connection

Hi Dears,

I have configured a proxy on the endpoints to allow them to establish a connection with the Broker VM. Everything is working as expected, and the agents’ status shows as "Connected."

However, while reviewing the Network Firewall, I noticed

Resolved! XQL query for host inventory with versions

Hi,

I need a XQL query which outputs all endpoints and installed versions of a specific application. I found a way to get all computers with the application installed, but no version of it:

 config case_sensitive = false
| dataset = host_inventory
|

Resolved! VMWare tools (vmtoolsd.exe) - Masquerading - 4203898100

Hello,

We're receiving this alert from 5th of March for some endpoints. There is nothing suspicious in the incident, file is signed and have verdict benign. Has been there a new content update that caused this alert? What should we investigate in s

Resolved! XQL query for complete beginner

Hello, i'm trying to create an XQL query that will show all alerts, as opposed to incidents. Is that possible?

Resolved! Cortex XDR XQL query to get list of all vulnerabilities

Hello All, 

Could someone assist me with a Cortex XDR XQL query to list all vulnerabilities along with their associated endpoints? I'm looking for a list that includes each endpoint and its unique CVEs.

also Does Cortex XDR gives remediation deta

Resolved! Rare Admin Login in Environment

Hi guys, could anyone help me with the query I'm trying to do. 

I'm looking to build an alert based on the rarity of a login in the environment. For instance, raise an alert if "admin" logged in to a device, but that action hasn't been seen in the dev