This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4547 Views
  • 0 replies
  • 3 Likes

Application WhiteListing

I have an application that needs whitelisting. Actions Done: Add to Allow List Add to Malware Profile, under specific module that triggered alert/incident. It is still showing up in incidents when executed. Any idea what could be going on?

jia_xuan by • L0 Member
  • 2574 Views
  • 3 replies
  • 0 Likes

Resolved! Installing Cortex XDR on a template

Hello, We want to prepare a template with all the installed applications including cortex, to use it in the new installations. How would it be done with cortex, would it be necessary to introduce some parameter in the installation, or with the usual installation would be enough. Best regards.

Resolved! XQL query to add a widget to know the Protection Paused more than 30 days.

Dear Team, I am trying to write an XQL query to add a widget to know the Protection Paused more than 30 days. The Query is as follows, can someone help me to get the accurate results. config timeframe = 30d| dataset = endpoints| filter manual_protection_pause != "PROTECTION_ACTIVE"| join type = left (dataset = management_auditing | filter de...

VenuK by • L2 Linker
  • 5882 Views
  • 6 replies
  • 0 Likes

AMSI Byte Array Scanning

Does anybody have a solution similar to Defender for Endpoint for using AMSI programmatically to scan incoming files? Essentially, we have a requirement to scan incoming files that are scanned prior to being sent along to their next hop. This all occurs in memory and never actually writes to the disk.

JAEvans by • L0 Member
  • 1893 Views
  • 2 replies
  • 0 Likes

Resolved! check cortex xdr agent status

Hi everyone, I have a doubthow can I check the status of the cortex xdr service / agent in windows 10 ?cause my client won't synchronize with server Thanks in advance. greetings.

Seka by • L1 Bithead
  • 21966 Views
  • 7 replies
  • 0 Likes

Resolved! Monitor and Collect Enhanced Endpoint Data in XDR

When setting the Agent profile in Cortex XDR, Under the check box when enabling "Monitor and Collect Enhanced Endpoint Data" is the following note: Note: Before enabling enhanced endpoint data collection make sure your Strata Logging Service storage capacity and quota allocation can support it. Please refer to the Strata Logging Service quota co...

Certificate Enforcement issue

We have several machines that are now reporting "Partially Protected" when we enabled Certificate Enforcement on them. First they started to show "Local-Store fallback used" in audit logs (informational severity), now we see "Failed to enable certificate enforcement due to local-store fallback" high severity messages and a Partially Protected...

rufat87 by • L2 Linker
  • 4912 Views
  • 5 replies
  • 0 Likes

Failed to get unit file state for traps_spmd.service: No such file or directory

Hello,I just installer a 8.2 XDR agent to a linux server"/opt/traps/bin/cytool startup enable all" returns Process name Startup statuspmd EnabledFailed to get unit file state for traps_spmd.service: No such file or directoryspmd DisabledFailed to get unit file state for traps_pyxd.service: No such file or directorypyxd DisabledI don't know what...

F.JEAN by • L1 Bithead
  • 3786 Views
  • 3 replies
  • 0 Likes

XQL Query - File Delete Action

Hi, Please may i know if anyone may have the issue i encounter since early May 2024? 1. Delete a folder (100+ files) from specific endpoint (right click mouse and select delete) 2. From Cortex XDR Query Builder - File Query and Select Action = Delete - filter the particular endpoint hostname/ip The query no longer returns the file delete/file r...

  • 2657 Posts
  • 101 Subscriptions
Top Solution Authors
View All
Latest Comments
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks