This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences

Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

 

Rules and Best Practices

 

  1. Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion
...

JayGolf by • Community Team Member
  • 590 Views
  • 0 replies
  • 2 Likes

Cortex XDR XQL Query

Hi Team,

Could you please provide us with the XQL query to retrieve the reasons behind the "Agent Disconnected" and "Connection Lost" statuses from Cortex XDR? I have attempted to create a query, but I haven't obtained any results. Please assist me

...

Resolved! Summarise XQL results by hostname

Is it possible to group\count\summarise results from an XQL query by hostname rather than seeing every entry for every event?

 

for example:

dataset = xdr_data
| filter event_type = FILE and
actor_process_image_name contains "Something" 

 

is there som

...

Querying BitLocker status on a certain endpoint

I am aware of "Disk Encryption Visibility" where we can see the encryption status all volumes under any endpoints. But it appears we can't filter on this field (Volumes Status).

 

Is there any way at all to programmatically answer a simple question l

...

tmeksik by • L2 Linker
  • 894 Views
  • 1 replies
  • 0 Likes

Denied URL - Broker VM

Hi team!

 

Does anyone have or have had a situation where the applet local agent settings show "Denied url: URL_HERE"? 

 

 Sometimes for short periods of time (around 5 -30 seconds) our broker VMs turn on in red the applet and we can see the message

...

MarcoMJ by • L1 Bithead
  • 1001 Views
  • 2 replies
  • 0 Likes

PALO ALTO CERTIFICATIONS

Hello Team,

Please help me with the names and links of the certificate and training links for all the certificates offered by Palo Alto related to Cortex XDR, Prisma Cloud and SoC along with  the cost of these certificates.

Thank you in anticipation.

...

  • 2255 Posts
  • 86 Subscriptions
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2025 - Palo Alto Networks