This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4435 Views
  • 0 replies
  • 3 Likes

Resolved! Any manual actions needed for new certificate enforcement?

With the announcement of certificate enforcement for Cortex XDR 8.3, I haven't seen any guidance on how to install or where to download the certificates that XDR agents will be using. The lack of information concerns me because I don't want to enable this setting and then have XDR break because the endpoints do not have the required certificate....

dgagnon by • L1 Bithead
  • 5235 Views
  • 5 replies
  • 0 Likes

Cortex XDR API get_endpoints vs get_endpoint

Hello, I've been using python script to get all endpoints /public_api/v1/endpoints/get_endpoints (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Endpoints). Recently there was another business requirement to get OS type of all endpoints and /public_api/v1/endpoints/get_endpoint seems to have more data and contain fiel...

Resolved! désinstallation cortex xdr 7.9 pour installer xdr cortex 8.3.1

Bonjour, je suis confronté à un pb de désinstallation de Cortex xdr 7.9.0.20664 , devant migrer en 8.3.1, j'ai lancé le XdrAgentCleaner 7.9.0.17288, a demandé le password de désinstallation, est bien passé puis a demandé de rebooter. J'ai fait la même desinstallation 3 fois avec reboot à chaque fois . J'ai tenté ensuite d'installer Cortex XDR 8....

Resolved! Looking for a XQL query to identify if a specific domain is accessed in our environment.

I have tried using the below XQL query to identify the domains accessed and tried to test it using my own system but somehow I am not getting all the results. For eg : when I tried common domain names like "google.com", "reddit.com". It worked and fetched results for me. When I tried to access a specific uncommon domain name like for eg : "https...

Report XQL Bitlocker

Hello, I created a report to display computers with Bitlocker that is not compliant : config case_sensitive = false | dataset = endpoints | filter encryption_status = ENUM.APPLYING or encryption_status = ENUM.NOT_COMPLIANT | filter endpoint_type = ENUM.TYPE_WORKSTATION | fields endpoint_name When I test with real data, for example, it report 1...

Parsing at Broker VM level

I'm using COLLECT parsing rule to manipulate data at broker VM level before ingestion Rule basically filters out on raw log that I generate specific to my test like some log line that contains text criticalevent along with some date and random machine name. [Collect: vendor="unknown", product="unknown", target_broker=(mybroker), no_hit=drop] fi...

Fm12345 by • L2 Linker
  • 1625 Views
  • 1 replies
  • 0 Likes

Block APP

Dear, I want to block an application, I configured it to block by the process, but when changing the name of the executable it also changes the name of the service as shown in the images. Would I be able to block it by the name that appears in the task manager?

Future of Cortex XDR

Hello dear community, we all now the future of SOC is Cortex XSIAM. What will happen to Cortex XDR in the future? I didn't see any planned new KI implementations into XDR. If you have more informations, please let me know. BR Rob

RFeyertag by • L4 Transporter
  • 1999 Views
  • 2 replies
  • 0 Likes

Long Malware Scan time, normal?

hello all experts, I have encountered a long scanning time, i launched a malware scan from console to isolated endpoint, the job was created at 15:30 and finished by 05:30 by next day. Guessing when the job was created, either the agent was disconnected/fail to sync/the server failed (through websocket) to connect to agent/scan was finishe...

Cortex XDR trap agent unable to connect the console

Hello! I got into a trouble with linux oracle and redhat, the trap agent was installed successfully, the agent is activate, broker_vm defined as proxy and it connected, in the console the endpoints were visible (even in the endpoint description also shown the configure proxy address) but the state is in disconnected and also I cant generate the ...

Resolved! Changing Broker VM's internal network subnet

Hi all Is there a way to change the internal network subnet through other means other than the webui? The default 172.17.0.1/16 collides with the network this broker vm is on. We are having trouble accessing the webui but somehow we can ssh in. Wanted to rule out the IP conflict issue before trying other things. Thanks Tum

tmeksik by • L2 Linker
  • 2727 Views
  • 1 replies
  • 0 Likes
  • 2624 Posts
  • 98 Subscriptions
Top Solution Authors
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks