Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

EU GDPR and UK GDPR?

Hello experts,

We have a branch in EU and UK

For easier management , just want to have single tenant for both.

Is it possible?

Under GDPR scheme, should I host one tenant for both UK and EU. is it possible?

Which one should I choose??

Thanks

SDG

Resolved! Quarantining files about 300 MB / Hunting big Files

Hello dear community,

what happens with quarantined files, which have 300 MB?

I can't download it from the action center like I am used to.

Yes, I saw they are moved to %PROGRAMDATA%\Cyvera\Quarantine), but can I get it from there?

Would y

...

Resolved! File search and destroy

Hello Team,

We are unable to delete certain file due to the error "Access is denied".

Is there any other way to delete these files.

Cortex XDR_Incident Tagging

Hello All,

Greetings for the day!

I would like to know if there is any way through which we can add the tag in the incidents and alert.

I can see 2 columns available in the alert and incident pane, but not able to edit it with the custom name lik

...

Resolved! True Positive / no incident / evasion / self made alerts helped to detect

Hello dear community,

got an 2 hour infection on a fat client from this https://www.virustotal.com/gui/file/79e3e243726a8b29b4cf74576e364ce98dfadb5bd182d8d1ed55255e70defc2c/details

This little guy was evading cortex xdr pro.

Whatch out and fill y

...

Resolved! Excluding hash for particular machine

Hello Team,

- We have added one of the hash in the block list and it is quaratined.

- In one of the test machine we need this file for testing purpose.

- Is that possibke to exclude this hash from the particular machine?

High medium low severity

Dear Team ,

On what basis high ,medium and low severity alerts/incidents are classified on cortex XDR

Regards,

Shashank

Resolved! Legacy Exceptions removal

We're looking through the Legacy Exceptions and some are no longer needed. To do this, do we need to activate them and then remove these exceptions?

Also could I please confirm that these exceptions already exist in the system and by clicking acti

...

Resolved! Manually update content version?

Is there a way to manually update the content version? I downloaded the agent install plus latest content version and I can't figure out what to do with the content version files or find a way to push the latest content version. This particular machi

...

Resolved! Cortex XSIAM + XDR

Hello dear community,

who of you is using XSIAM? How is it?

Will XDR + XSIAM ever get together in one product?

Rob

Resolved! XQL filter o365 attachments

Hi,

I am trying to filter o365 attachments without success, could you help pls

sample

[
  {
    "@odata.type": "#microsoft.graph.fileAttachment",
    "@odata.mediaContentType": "image/jpeg",
    "id": "AAMkADEzYjJhMzM1LTY0ODctNGUxOS05ZDc5LTQ2MW

...

Cortex XDR with VDI persitent Desktop

Hello,

We use the Vmware Horizon VDI solution in Instant Clone with FSLogix profiles and a dedicated machine based on a Golden Image (Automated, Instant Clone, Dedicated).

A user therefore always connects to the same machine, which is updated fro

...

Smartscreen functionality side by side with the Cortex agent on FAT-Client (not Server)

Hello dear community,

the Cortex XDR agent disables Windows Defender on FAT-Clients automaticly.

Does Smartscreen in "App & Browser Control" still work in this state?

Rob

Resolved! Possibility to use cloud tags to replicate them into Endpoint tags.

Hi,

is there a way to re-use populated Cloud tags (eg. from AWS cloud) into Tags used for Endpoint distinktion and dynamic group definition?

Thanks

Ondrej R.

Multiple detection on Suspicious Network Activity - 3045255237

Hello ,

We are a MSSP and since less than one hour, a new rules appeared in many of our Cortex XDR tenant : Suspicious Network Activity - 3045255237 involving the IP 2.58.113.190. The communication is launched by the process System, like if a rootk

...

User

Likes Count

8 Likes

4 Likes

2 Likes

1 Likes

Cortex XDR Discussions

Discussions