Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Resolved! Endpoints with Public IP

Hi All, looking for some help here on creating an XQL query to search for any endpoints that are assigned public IP addresses. I searched and didn't see anything in the Live Community that already speaks to this.

I appreciate any support you can prov

...

Cortex XDR AWS Marketplace

Hey,
I've recently purchased Cortex XDR via the AWS Marketplace - I haven't gotten an email or indication that my Cortex XDR instance has been created or what it's status is.

Would love some help with this!
Thanks,
Itai

Resolved! Dump alert data Analysis

Does anyone know how we can and how we should analyze a dump file when we do a retrieve alert data on Cortex XDR #

I've alerts related with memory dump, normally initiator is excel, and 99% i think the cause is excel crash or file have macros/vba ins

...

Unauthorized - 4010402

Hi Community,

Has anyone encountered the "Unauthorized - 4010402" error when trying to log into their tenant account? I attempted to log in, but I received this message. Does anyone know what could be causing this issue or how to resolve it?

Thanks i

...

Resolved! Delay in launching in-house apps

Our users have noticed there are delay in launching in-house developed apps (20+ apps) for the first time, the delay would take 10-20 seconds, once the app initally launched, the later, it would take 2-3 seconds to launch. The apps are located from s

...

Resolved! Cleanup endpoint and CVE List

Hi,
I need your help to understand if there is an option on Cortex XDR to periodically clean up the endpoint list (for lost connections) and remove any vulnerabilities associated with those endpoints.

Resolved! Find Incidents/Alerts triggered based on 3rd Party Integrations

Hey!

We've recently added a 3rd party integration "Office 365" to Cortex XDR's Log Collection.

I was just wondering if there was any obvious way to find alerts/incidents that triggered based on Office 365.

Kind Regards,

Bojan

Resolved! XDR agent quota exceeded

We were monitoring the XDR Agent Audit logs and found out a lot of agents have this alert Quota Exceeded: "XDR agent quota exceeded on ******."

Can anyone explain this?

Resolved! View exported Policy details from console

Hi,

We have exported all the policies from the console (.export) format but are unable to view them or open them anywhere.

Kindly help me view these exported policy details.

Thanks

Md.Shahwaz

Cortex XDR Connection method

Hi, While monitoring network traffic during our deployment, we noticed that all traffic between the endpoint and the XDR portal (<xdr-tenant>.xdr.<region>.paloaltonetworks.com) is one-directional (outbound).

We have private Linux servers in a separ

...

Resolved! Feature request submissions

Does anyone happen to know if there is a feature request option or method for Cortex XDR?

XQL query for critical commands

Hi everyone.
I'm trying to create an XQL query for a BIOC that will trigger an alert when specific commands are run.
I've tried the "visudo" and "sudo -l" commands on two servers. On one it detects both commands and on the other it only detects the "vi

...

Clean up Tags list

Hello All,

I want to clean up my tags list, because some of the old tags that we used are not needed any more.

We don't have active devices with tags that I want to remove.

Any idea from where i can do that?

Regards,

Vasil

Resolved! Windows 11 security features

We are in the process of testing/implementing Windows 11 OS on endpoints and noticed upgraded security features that are available to toggle on. Some of these protection features are already within the cortex polices.

If we toggled these features

...