This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4322 Views
  • 0 replies
  • 3 Likes

Resolved! Notification when alerts/Incident is resolved

Hi CommunityI am trying to get notifications when alerts or incidents are resolved but it doesnt seem that there is a direct way to do so.So is there a way to send a notification (Syslog or Email) when an alert or an incident is resolved?Thanks in advance.

Belhaj_a by • L1 Bithead
  • 2400 Views
  • 2 replies
  • 0 Likes

Resolved! Automatic review of Cortex XDR for Prevention Profile: Agent Settings, Malware and Exploit

Hello Together I would like to automatically review the settings in the Cortex XDR Prevention Profile: "Agent Settings", "Malware" and "Exploit". As example that in the Agent settings, the Disk Space Quota should be set between 5000 and 2000 MB or that the Uninstall PW is Defined ... Are there ways to automate this process? As an example, I ...

MikeDups by • L0 Member
  • 2074 Views
  • 1 replies
  • 0 Likes

Multiple Paths in Disable Prevention Rules

HelloIs it possible to specify multiple values while creating prevention rules exception for one "application" ? If so what is the schematics of adding those ?Especially in path section. As if application has multiple location paths for its different modules such as C:\program files (x86)\ or %program data% or C:\program files\ etc where wild ca...

how frequently XDR will push logs to Cortex?

Hi, how frequently XDR will push logs to Cortex? We have application it will write logs 400k per sec and log rotation setup like if file size is 50 MB it will compress the file and zips it. due to this we are missing logs in cortex xdr. can you please suggest any solution . TIA.

Application WhiteListing

I have an application that needs whitelisting. Actions Done: Add to Allow List Add to Malware Profile, under specific module that triggered alert/incident. It is still showing up in incidents when executed. Any idea what could be going on?

jia_xuan by • L0 Member
  • 2349 Views
  • 3 replies
  • 0 Likes

Resolved! Installing Cortex XDR on a template

Hello, We want to prepare a template with all the installed applications including cortex, to use it in the new installations. How would it be done with cortex, would it be necessary to introduce some parameter in the installation, or with the usual installation would be enough. Best regards.

Resolved! XQL query to add a widget to know the Protection Paused more than 30 days.

Dear Team, I am trying to write an XQL query to add a widget to know the Protection Paused more than 30 days. The Query is as follows, can someone help me to get the accurate results. config timeframe = 30d| dataset = endpoints| filter manual_protection_pause != "PROTECTION_ACTIVE"| join type = left (dataset = management_auditing | filter de...

VenuK by • L2 Linker
  • 5289 Views
  • 6 replies
  • 0 Likes

AMSI Byte Array Scanning

Does anybody have a solution similar to Defender for Endpoint for using AMSI programmatically to scan incoming files? Essentially, we have a requirement to scan incoming files that are scanned prior to being sent along to their next hop. This all occurs in memory and never actually writes to the disk.

JAEvans by • L0 Member
  • 1747 Views
  • 2 replies
  • 0 Likes

Resolved! check cortex xdr agent status

Hi everyone, I have a doubthow can I check the status of the cortex xdr service / agent in windows 10 ?cause my client won't synchronize with server Thanks in advance. greetings.

Seka by • L1 Bithead
  • 20094 Views
  • 7 replies
  • 0 Likes

Resolved! Monitor and Collect Enhanced Endpoint Data in XDR

When setting the Agent profile in Cortex XDR, Under the check box when enabling "Monitor and Collect Enhanced Endpoint Data" is the following note: Note: Before enabling enhanced endpoint data collection make sure your Strata Logging Service storage capacity and quota allocation can support it. Please refer to the Strata Logging Service quota co...

  • 2589 Posts
  • 95 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks