XQL use to or operator in the Regextract

Hi

I want to use or operator in XQL regextraxt but the following command does not work. Can you help us.
Thank you.

|alter etki=regextract(message ,"Etki\sAlanı\sAdı\:\s+([^\n\r]+) | Domain\sName\:\s+([^\n\r]+)")

Cortex XDR_ Device Control Violation_ Policy Management

Hello All,

Whenever the user is connecting any device in the system which is not allowed, we get the logs in the device control violation regarding that device.

In such case, what changes are required-

a) Allow the device through device permanent

Secshow.net

Hi All,

can you help for information i need

attach the picture.

what are the meaning thread id tunneling:secshow.net ?

thanks

Where to publish EDL

Hi,

I was planning to use Cortex XDR as my EDL publisher but since it doesn't support networks, only single IP addresses, it is useless for me. I don't want to publish it on our IIS servers so I'm looking for good alternative. Can anybody suggest som

how I add exclusion based on for an specific process (license.exe) for specific endpoint

Hi family 

How I add an  exclusion based on for a specific process allow  (license.exe) for specific endpoint on cortex xdr. wildfire are blocking this process many times so i want to allow for this service for specific endpoint. 

thanks, and regards.

is there a way to pass the password to cytool via cmd?

let say I want to run protect disable on 100 computers....  I tried the following but didn't work:

C:\PSTools>psexec -i -d -s \\pc100 cmd /c echo 5Nstall22#| "c:\program files\Palo Alto Networks\Traps\cytool.exe" protect disable

5Nstalll22# is the pas

Cortex XDR_Behavioral threat detected (rule: excel_virus)

Hello All,

Greetings for the day!

We are getting multiple high severity alerts/incidents related with excel files because of Behavioral threat detected (rule: excel_virus).

Within the time span of 4 hours we have received 28 high severity aler

Cortex XDR Alerts not appearing in the Admin Portal under Incidents >Alerts?

Hi all,

Recently we've been experiencing some alerts (which we believe to be false positives) but are unable to see these alerts in the admin portal. Is there any configuration required to generate Admin Portal alerts in the Alerts Table? Or should

create a tag in fireall

"Hi,

We have multiple VM brokers, each connected to the same model of firewall. However, in a recent incident, it was difficult to identify the source of the incident from which the firewall it originated. We're exploring two potential solutions:

1.