Maximum telemetries data that can be stored offline

Hi team

Is there a cap for how much telemetries data can be stored offline? Or does it simply depend on how much disk space is available?

I am wondering if an agent has stayed disconnected for an extended period, would it be able to upload all telem

VDI flagging as "Standard" install type

I am not our virtual infrastructure guy, but he is stating that the VDI=1 flag is set on the golden image, however, the column "Installation Type" in the console is showing standard.

Has anyone else every had this issue? Normally I wouldn't care ab

Cortex Email Security Module

Hi, has anyone implemented the below XDR Collection Integration?  We are curious at the experience especially any unwanted impacts or excessive alerts.

Cortex Email Security Module: Defending Against Evolving Email Threats - Palo Alto Networks Blog

Ing

How I can Use host Firewall on Cortex XDR for blocked RDP conexion

Hi everyone, I'm new user of cortex.

I need your help to use Host Firewall on Cortex for block RDP coneccions and permit only some groups,

I can block it using port, but I need allow conexion for IT group, i created two rules, one blocked RDP por

Create Alert from Data Lookup

Hello everyone,
I have a reference dataset from IBM QRadar that I’ve stored as a lookup dataset. My goal is to create an alert if a malicious file is downloaded or opened. How can I achieve this or is it possible using BIOC?

Adding exception for weekend

Hey guys, I’m looking to exclude some detections that occurred over the weekends and could use a hand with crafting that query.

dashboard to view logins

What's up community!

I'm trying to create a dashboard in Cortex XDR that allows me to see user logins and log outs.

Is this possible with XQL? Or, for example, log when the endpoint was powered on.

I would greatly appreciate the help.

#cortex #cort

How to Deliver Upgrades to Endpoints with a Connection Lost Status

Dear Community,

I am encountering a challenge with the XDR agent upgrades. Although we distribute updates through the Action Center, agents in a "Connection Lost" state are not included as upgrade targets.

In our environment, some devices remain offl

Warning on malware profile being set to report only

Is anyone else seeing warning being generated on malware profiles and and their associated policies please?

For a couple of weeks, all of our Windows policies have been in a warning state. Investigating this we found that the malware profile was ge

Integrating Log Audit Management XDR / XSOAR

Dear Community,

Is there any documentation about how to integrate Audit Management XDR and XSOAR for a SIEM like Elastic? I need a centralized log audit for monitoring.

Thanks