General Cortex XQL questions

Hello, 

I have been unable to confirm the following information in the online guidance I have been looking through.

How far back can we run an "All Actions" query in XQL? For example, can we search for file hashes going back 3 months or longer?

Also

BIOC that will close web browser while opening certain websites

I want to create a BIOC rule that will close web browser (ex. chrome) when I open certain websites (ex. facebook.com and instagram.com). I'm using Network BIOC and I managed to create BIOC rule that applies only to one website (remote host) but I don

Microsoft 365 email collector

Hi Everyone

Regarding the new email collector which ingests email logs and data from Microsoft 365: Ingest logs and data from Microsoft 365 • Cortex XDR Documentation • Reader • Palo Alto Networks documentation portal

Has anybody figured out a wa

Performance Optimization Strategies

Hello,

I have a system running workloads that is sensitive to CPU usage. The primary users have raised an issue that our currently applied XDR profile is causing detrimental delays in job processing. I confirmed this by disabling the agent to obser

Blocking connections to malicious IP address?

Hello, 

I have a question. I have Cortex XDR agents installed on my endpoints. I just recently also installed Forti Analyzer and it detected some potential malicious IP addresses that my endpoints have connections to. I wonder why Cortex XDR cannot

Need help with BruteForce XQL query

Hi i am trying to craft a query for bruteforce based on 30min timeframe with threshold of more than 5 failed login attempts. But i am having trouble figuring out how to configure the logs for a 7 Days monitoring.

Please kindly help me refine the qu

Cortex XDR Installation Error

I am trying to install Cortex XDR in Windows 10, but I'm getting the following error: I tried different versions as well. Could anyone please provide guidance on this?

Thumb drive auto-scan

Can we force XDR to scan a USB drive when it is connected to a PC with the agent installed? Using XDR Pro.

path exclusion for scans do not work

Hello to all,

I am experiencing a problem on a machine where scans are pushing the overall CPU load to 100% for several minutes to several hours and only slowly decreasing.

This causes problems for the use of the Syngo.Via software installed on thi

CIE integration

In case of hybrid environment,Can we send data to CIE instance from both Azure AD as well as on-prem AD as it supports both.

Or it is enough if we send data only from on-prem AD alone.