This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4393 Views
  • 0 replies
  • 3 Likes

Resolved! XQL query to add a widget to know the Protection Paused more than 30 days.

Dear Team, I am trying to write an XQL query to add a widget to know the Protection Paused more than 30 days. The Query is as follows, can someone help me to get the accurate results. config timeframe = 30d| dataset = endpoints| filter manual_protection_pause != "PROTECTION_ACTIVE"| join type = left (dataset = management_auditing | filter de...

VenuK by • L2 Linker
  • 5525 Views
  • 6 replies
  • 0 Likes

AMSI Byte Array Scanning

Does anybody have a solution similar to Defender for Endpoint for using AMSI programmatically to scan incoming files? Essentially, we have a requirement to scan incoming files that are scanned prior to being sent along to their next hop. This all occurs in memory and never actually writes to the disk.

JAEvans by • L0 Member
  • 1809 Views
  • 2 replies
  • 0 Likes

Resolved! check cortex xdr agent status

Hi everyone, I have a doubthow can I check the status of the cortex xdr service / agent in windows 10 ?cause my client won't synchronize with server Thanks in advance. greetings.

Seka by • L1 Bithead
  • 20900 Views
  • 7 replies
  • 0 Likes

Resolved! Monitor and Collect Enhanced Endpoint Data in XDR

When setting the Agent profile in Cortex XDR, Under the check box when enabling "Monitor and Collect Enhanced Endpoint Data" is the following note: Note: Before enabling enhanced endpoint data collection make sure your Strata Logging Service storage capacity and quota allocation can support it. Please refer to the Strata Logging Service quota co...

Certificate Enforcement issue

We have several machines that are now reporting "Partially Protected" when we enabled Certificate Enforcement on them. First they started to show "Local-Store fallback used" in audit logs (informational severity), now we see "Failed to enable certificate enforcement due to local-store fallback" high severity messages and a Partially Protected...

rufat87 by • L2 Linker
  • 4529 Views
  • 5 replies
  • 0 Likes

Failed to get unit file state for traps_spmd.service: No such file or directory

Hello,I just installer a 8.2 XDR agent to a linux server"/opt/traps/bin/cytool startup enable all" returns Process name Startup statuspmd EnabledFailed to get unit file state for traps_spmd.service: No such file or directoryspmd DisabledFailed to get unit file state for traps_pyxd.service: No such file or directorypyxd DisabledI don't know what...

F.JEAN by • L1 Bithead
  • 3540 Views
  • 3 replies
  • 0 Likes

XQL Query - File Delete Action

Hi, Please may i know if anyone may have the issue i encounter since early May 2024? 1. Delete a folder (100+ files) from specific endpoint (right click mouse and select delete) 2. From Cortex XDR Query Builder - File Query and Select Action = Delete - filter the particular endpoint hostname/ip The query no longer returns the file delete/file r...

XDR Query Builder

Hi, I'm trying to use Query Builder but unable to get any results. see also attached screenshot. But when I perform a XQL search with query "dataset = endpoints" it gives me results. What should be done so I can use the Query Builder? thanks

Cortex on iPhone

Hi everyone, I have a few questions: I installed the Cortex app on my iPhone and allowed all the required permissions, but every time I close the app (swipe up), it stops working. The Cortex app is terminated, and the agent is not running. Is there a way to make the app continue working even when it is closed? In the "Modules" section, under...

  • 2611 Posts
  • 98 Subscriptions
Top Solution Authors
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks