Deploying Cortex XDR Agent for macOS with VMware Workspace ONE (AirWatch)

In order to deploy the Cortex XDR Agent to macOS you have to have both the Config.xml and Cortex XDR.pkg files bundled in the same deployment file. Workspace ONE does not support the uploading/deployment of a .zip file so you have to use a workaround

Cortex XDR trail version for testing purpose.

We are trying to integrate the Cortex XDR incident logs to Splunk using the API pull method. We customised the Splunk TA taking reference from the Splunk TA for Palo Alto NW.  So is there a trail version of Cortex XDR available in order to test the i

Script for Agent Upgrades

Does anyone know of a way to build/apply a script in XDR that would perform agent upgrades at scheduled times? 

Example: upgrade to latest agent version on 10 endpoints starting at 8PM on Saturday. 

Disk Decryption on MAC OS

Hi Everyone,

I'm seeking for help on how to decrypt the drive on MAC OS after the encrypting the drive using the Cortex XDR Tenant/Console?

I tried to check and use on this documentation guide by Palo Alto Networks but I think it is not working o

XDR and XSOAR mirroring fails

Hi, I have XDR integrated with XSOAR for bidirectional incident mirroring...

The strange thing is that when I close incidents in XSOAR as false positives, they appear as 'Resolved other' in XDR via the API...
If I close incidents as false positives

Application Severity Score

Hi, I noticed a "Severity Score" in Applications under Host Inventory but there doesn't seem to be any scoring happening. Is this apart of a license we may not have or does this not function the way I would imagine? I assumed maybe CVEs for applicati

Behavioral Threat Rule inject_rwx_module_to_long_live

Does anyone know what the following behavioral rule means in Cortex XDR 

        "alert_description": "Behavioral threat detected (rule: inject_rwx_module_to_long_live)",

I can't find it anywhere in PaloAlto documentation or anywhere else on the forums

Can/Does cortex XDR agent perform real time scan on drives responsible for "Live" video streaming?

After we got cortex XDR installed, some of the endpoints intermittently freeze during live video streaming. So wanted to understand if XDR does real time scanning on these drives

AWS tags in the Cloud info field?

We have hundreds of AWS assets with lots of information in Cloud Info, but none have anything in the tags field.

Has anyone else seen (not seen) this?

Just to clarify, I am not talking about Cortex XDR tags.

Thanks

User details

Hi Team,

Can we check user details on the XDR console - Local user with admin privileges?

Any way to identify such users?

Regards,

Shahwaz

XDR on Linux Appliances

Hi All,

Can XDR be installed on these servers -

• Checkpoint
• Force Point DLP Protector
• Cisco Expressway
• Trend Micro - Smart Protection
• Z Scaller Application
• Trellix-NDLP

Thanks,

Shahwaz