Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

CrowdStrike XDR Use cases with Pala Alto Cortex

Hi Team,

Can you please suggest a few case studies where CrowdStrike XDR is integrated with Cortex SOAR and what were the areas and use cases that were implemented and helped the customer?

We wanted to present this to a management that already has

...

Cortex XDR Periodic Endpoint Scanning schedule

We have a new compliance requirement to Perform periodic scans of the system at least every 72 hours and real-time scans of files. We currently have the schedule set to scan weekly. But I do not see the option to scan more frequently. Is there a

...

Resolved! [Cortex XDR] - What is the difference between Cortex XDR Pro and Prevent License?

Hi Everyone,

What is the difference between the Cortec XDR Pro and Prevent licenses? Does Prevent collect data? What is the difference between the data collected by the two licenses? Thank you.

Cortex XDR Agent for Linux with 1 GB RAM and 1 CPU

Hi,

I have a customer with linux machines with few resources.

There is any agent to Linux machines with only 1 GB RAM and 1 CPU?

Regards,

Fábio Ferreira

Cortex XDR Blocked Trend Micro Services [TmCCSF.exe]

Dear All,

Suddenly Cortex XDR blocked Trend Micro Apex One Services [TmCCSF.exe]

Resolved! Cortex XDR agent with linux agent as server type

Hi,

I have installed agent in several linux machines, but all are being categorized as Server Type and some are workstations.

Since I am using dymanic groups, what should I do to "fix" this? (Windows are OK regarding server type and workstations ty

...

Resolved! How to add Windows DHCP logs to enrich Assets data

Hi Everyone,

I am totally new to Cortex XDR and trying out the latest Pro version. What I wish to do is simple and I saw others discussed about it. But I really really need clear instructions on how to do that. In the All Assets list, we wish to get

...

Resolved! XDR Prevent to Pro

Does anyone even use Prevent anymore besides us? 

Our budget's been approved to hopefully upgrade our license structure to Pro during Q1 of next year. Does anyone have any recommendations / tips / suggestions or whatnot to make this migration a su

...

Resolved! Rename Tenant URL

Hi Community

We would like to change the URL of a Cortex XDR tenant to newname.xdr.eu.paloaltonetworks.com and then use the old URL oldname.xdr.eu.paloaltonetworks.com for a new tenant.

How long do I have to wait with the tenant activation until

...

Resolved! Advanced API monitoring profile.

Hi Team,

We need some clarification. We've enabled Advanced API monitoring for Windows. Could you please let us know if this functionality is also available for Linux and Mac?

Resolved! Cortex XDR Pro Per GB License

Hello：

Does anyone know if XDR Pro Per GB license can operate alone?
If I only want to analyze Firewall events, can I just buy a Per GB License?
Is there any documentation that can explain this?

Thank you

XDR - Printing delay all documents

Hi,
Has anyone had a delay in W11 with Cortex XDR , when trying to print, for example, a PDF
In my case, to print a simple 1mb pdf... edge opens the pdf by default... and when we do CRTL+P, we wait 1 to 2 minutes, until the preview appears and we can p

...

How to detect Cortex XDR agent stoppage if agent audit logs are being forwarded to SIEM ?

I am currently ingesting XDR agent audit logs to MS sentinel. Is there a way to identify if someone/adversary has managed to stop/disable the XDR agent ? I also want to avoid False positives by filtering out scenarios where the Host itself is powered

...