Hi everyone,
As we know that XDR agent can block the execution of any particular executable files but can anyone let me know whether XDR agent can block the download of any particular executables like winrar.exe, ccleaner.exe, etc. from any source li
...
Hello!
As I know, samples which are provided to VT, are "lost" in the endless VT world. VT can do with the files what they want. (Sharing, etc.).
When we connect Cortex XDR with VT, what will be transfered to VT?
What are the limitiations with Cortex
...
Hello everyone,
Would like to know your recommended best practices for post-implementation/management of Cortex XDR pro for Endpoint and TB.
Also, it will be also great if you can share a KT document for it.
Thanks
Is it safe to install paloalto cortex XDR solution?
If we install in our premises then our client machine data may get compromised if cortex scan for malware on cloud. Then what is the use of proxy broker server. I want my data must be safe and it sh
...
Hello,
We would ike to know if it is possible to create a list of IP's that will not be analysed by any of the XDR protection modules.We have a vulnerability scanning tool that uses all sorts of scripts to perform its tasks, At the moment, most of th
...
Hi
Anyone successfully ingest logs from Cisco ISE to Cortex XDR via syslog?
I've activated the syslog collector of broker VM for TCP514 and format set to auto detect, following this documentation, and configured the Cisco ISE to forward the logs to
...
Hi ,
I found many event about "EDL Authentication fail" on Management Audit log at Cortex XDR console since Mar 17,2022 until now.
But I didn't enable EDL why I got this event that was generate every minute . Please advise how to clear this event .
Th
...
Recently, by purchasing a per TB licence, I integrated the logs of the Fortinet firewall, but I found that the daily data volume in the data ingestion dashboard and the log volume in the Fortinet datasets do not match. The dataset of the Fortinet onl
...
Hello,
Found several threads on this topic, but no clear solutions.
Do we have en working solution with a clear description ?
Hello,
I have been digging through various Cortex documentations to find explicit language around log integrity, tamper protection of logs from administrators. I am aware that RAW Logs are not accessible to tenant admins however, could you point me i
...
Greetings ,
The single most common and repeating alert which we are getting is like below :
'' 173 'Hijacked DLL Injection' alerts detected by XDR Agent on 24 hosts ''
Explanation is 'DLL attempted to load from blacklisted location' .So 2 questions her
...
Hello,
I have turned off alerts on NGFW for Private URL, but I still get threat ID #9999.
Can somebody a little bit more explain what this threat ID means? I am trying to clean it up, but still get these alerts.
And it is not any kind of malicious tr
...
Hi folks, got a problem that i would like som input on.
I have an ubuntu endpoint with a xdr agent installed. said agent has given me a high severity alert about several items on this ubuntu endpoint - Kite(which, seeing how kite can install itself au
...
Hi community, I am new here.
I am trying to integrate the Cortex XDR API for incidents into Azure Sentinel using the new Codeless Connector Platform (CCP). The challenge I have is that the Cortex API doesn't appear to have any indicator as to where
...
