cortex xdr not able to connect to server
hello,
i'm facing an issue with cortex xdr agent, it's not able not connect to server , protection mode is always disable.
but internet connexion is allowed to this server.
any help please.
BR.
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.
hello,
i'm facing an issue with cortex xdr agent, it's not able not connect to server , protection mode is always disable.
but internet connexion is allowed to this server.
any help please.
BR.
Hello Everyone,
I have a following question: Since XDR agents are able to detect unmanaged assets in their network (without Broker VM), how can I get that information via XQL ?
Any information will be usefully.
Thank you
Is there a feature in Cortex that allows us to monitor which endpoints use USB to transfer data?
For legal reasons in our organization we have servers that can only be accessed in administrator mode if another authorized person authorizes access. That is, under no circumstances can a single person get administrator permissions.
Following this po
...
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-Malware-Security-Profile
The docs says:
(Optional) Add files and folders to your allow list to exclude them from the examination.
+Add a file or f
Hello all,
is there a way to find all endpoints that have WSL installed on them? Does Host Insights provide this or would I have to run endpoint scripts in order to retrieve this information? If so can someone please provide an examples?
Many thanks
...
Today we started to get alerts for all our MSI laptops with the reason: "Behavioral threat detected (rule: msi_stolen_certificate.1)". The alerts trigger on the MSI software installed on the latops, like "MSI center", or "One dragon center".
Are th
...
Hi there,
We have have recently started ingesting PAN NGFW logs into XDR, however they're generating a lot of incidents, for now I have excluded - prevented/terminated events, does anyone have any information on best practices, useful ways to use
...
I've been trying to configure Cortex XDR version 8.0.1.33809 to be deployed when configuring a laptop with autopilot. I downloaded the agent directly from Cortex XDR, configured it with the intune app creator to convert from an .msi file to a .intune
...
I have once upon a time set the system threshold exception to 100 hosts. So when the same BIOC is triggered on 100 hosts at the same time, it automatically creates an exception. I would like to raise the number of hosts, but I cannot find the place t
...
Hi all,
Got a question - can the XDR block registry changes on windows machines? I'm talking about a blanket block, not just on the agent's own registry keys.
Hello All,
Was curious, is there a related registry key for Traps last check-in date? I'm curious if there is an easy way to pull in that information with powershell.
Quick example scenario would be that we would use one script to pull in the las
...
Hello all,
I have identified that the Analytics and BIOC Analytics is identifying real threats yet no action has been initiated due to the log source. Is it possible to increase the severity of these rules to Medium and higher ?
Secondy, is it possi
...
Hello dear community!
I am testing some XQLs from the last webinar.
In my test I fired following XQLs one on one, but I do not understand why the left join doesn't work. I allways get 7 results with the host inventory users preset. Without I get 1
...Subject | Likes |
---|---|
2 Likes | |
1 Like | |
1 Like | |
1 Like | |
1 Like |