Resolved! Cortex XDR 7.4.1 crashing server

After the installation of xdr 7.4.1, our domain controllers began crashing, and even after a reboot they would lock up.  Has anyone had any issues with the 7.4.1 release on Windows Server 2012 R2?

Based on a Windows Dump, Microsoft reported the follo

Resolved! Post detected by Wildfire

Hello dear community, 

what means Detected (Post Detected)? 

In our case, we see pdfpower.exe incidents popping up, the user says he didn't download anything to the incident time.

I think, the agent is scanning the OS, when there is allready a quaran

Resolved! Event Logs That Are being Gathered With Cortex XDR - Windows

Hi Everyone,

I was doing some research on Event IDs that are being gathered by Cortex XDR and I came to the conclusion that the Event ID needs to be enabled on the Windows first so XDR is being able to gather them.
XDR probably does not overrule th

Resolved! ShroudedSnooper targets security components of Palo Alto Networks Cortex XDR

Hi All.

There is a malware that is targeting the components of Cortex XDR, I checked the security advisories page from Palo Alto but did not find anything related to it.

Can someone help me find out if there's anything from PA regarding the same an

Resolved! Events That Cortex XDR is Logging

Hi everyone,

Does anyone have a list or any reference to a document where I can see which logs Cortex XDR is gathering from a Windows endpoint? For example, to clearly know, that XDR is gathering all file event types, process creations, gathering even

Resolved! C:\ProgramData\Cyvera\Ransomware folder

Hello there,

What is the purpose of this folder(C:\ProgramData\Cyvera\Ransomware) for Cyvera? Couldn't find even a mention for it so it decided to ask the community.

Thanks

Resolved! Create IoC to detect email address from O365 log

Hi,

I am adding an email as a IOC in Cortex XDR, but it is not being detected through O365 logs.

Could you help?

O365 log

fieldname : "sender"

data: "{"emailAddress":{"name":"XXXX","address":"xxxx@xpto.com"}}"

Regards,

Resolved! XDR Resource IPs for Connectivity to XDR Server

Dear experts, 

From the following resource table, two json tables for GCP are provided (one for Google subnet and another for Google IP range associated with my region)

Question:

For the connectivity, do we need to allow all GCP IP range (in the

Resolved! Agent v.7.9 Removed???

Hello experts,

From the matrix, v7.9 supposed to be the last version to support Win7, just found out 7.9 has been removed from the Agent installation while creating an installer. 

Do we need to "downgrade"/use much older v5.0 instead???  

Resolved! Hashes of the attachment from the o365 log

Dear community,

I've been evaluating the benefits of ingesting o365 logs so far. Seeking those who have the mentioned logs ingested into Cortex XDR -

does Cortex XDR review and raise alert using the hashes of the attachment if the attachment is a mal