XDR Capabilities

Does XDR has the capability to identify and block admin access on end user workstation?

Scaning files for malware

Is it possible to use Cortex XDR to analyse malicious Microsoft Office files, such as Word, Excel and PowerPoint documents? If I right click on Office file and choose Scan with Cortex XDR will Cortex check if that file is not used for delivering malw

Legacy Exceptions - Endpoint version compatibility

Hi, everybody,

I plan to accept Legacy Exceptions générated from my profile based policies.

Major part of the endpoints are running [CE] versions, prior to 7.9. All these versions are supported.

Does anyone had problems when activating these Lega

What happens to existing prevention profiles when enabling the "Host Insights" license?

Hello 

Does anybody know what happens to the configuration of existing prevention profiles when the "Host Insights" license is activated? The environment currently has several prevention profiles that have the "XDR Pro Endpoint capabilities" enable

Automate Isolation Endpoint

Just wondering if there is somewhere in xdr to tell it to isolate an endpoint automatically if we get a critical/high/medium alert or confirmed malware/ransomware alert.

I thought there was something in the profiles to change for active this functi

Deploying Cortex XDR Agent for macOS with VMware Workspace ONE (AirWatch)

In order to deploy the Cortex XDR Agent to macOS you have to have both the Config.xml and Cortex XDR.pkg files bundled in the same deployment file. Workspace ONE does not support the uploading/deployment of a .zip file so you have to use a workaround

Cortex XDR trail version for testing purpose.

We are trying to integrate the Cortex XDR incident logs to Splunk using the API pull method. We customised the Splunk TA taking reference from the Splunk TA for Palo Alto NW.  So is there a trail version of Cortex XDR available in order to test the i

Script for Agent Upgrades

Does anyone know of a way to build/apply a script in XDR that would perform agent upgrades at scheduled times? 

Example: upgrade to latest agent version on 10 endpoints starting at 8PM on Saturday. 

Disk Decryption on MAC OS

Hi Everyone,

I'm seeking for help on how to decrypt the drive on MAC OS after the encrypting the drive using the Cortex XDR Tenant/Console?

I tried to check and use on this documentation guide by Palo Alto Networks but I think it is not working o

XDR and XSOAR mirroring fails

Hi, I have XDR integrated with XSOAR for bidirectional incident mirroring...

The strange thing is that when I close incidents in XSOAR as false positives, they appear as 'Resolved other' in XDR via the API...
If I close incidents as false positives