Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Resolved! Cortex XDR Incident integration splunk tool

We are currently integrating the Cortex XDR incident logs with the Splunk tool. Currently, the incident logs are visible in the Splunk tool, but certain essential fields required for conducting an XDR log investigation are not available in the existi

...

Resolved! Difference between host_inventory and endpoint in XQL Query

Hello,

I'm trying to search for all installed vpn on endpoints using an XQL Query.

Before going further in my query, I'm trying to list all hosts where the application name contains "*vpn*".

This result and the result from host insight doing the

...

Resolved! Cortex XDR: Bitlocker Monitoring

Hello everyone,

We are looking at using XDR to monitor Bitlocker status on Windows machines. On the 'Disk Encryption Visibility' page, we can see the Encryption status, but there is no way to filter on 'Unencrypted' drives.

- Does anyone know of an X

...

Vulnerability assessment report

Applied monthly pathing to the environment but count is not decreased and increased remains can suggest this issue?

XQL Query

Hello,

Need XQL query where the particular endpoint comes online need to notify us.

Resolved! Cannot delete endpoint group

I want to delete a static endpoint group and get this message:

CANNOT DELETE GROUP

Please note that this group is defined as an endpoint scope in the user permissions

Remove all references to this group before deleting.

I checked for scope references i

...

Verdict for the detected files

Hello Team,

What action needs to be taken on verdict for the detected files

For example: if file verdict is Benign - what action we need to take. similar on malware and grayware.

Incident scoring rules

Dear LIVEcommunity,

Our environment had the SMART score enabled and now I'm working on incident scoring rules to make the VIP username and/or their devices stand out when alert generated matched their username/hostname.

I had their information fl

...

EU GDPR and UK GDPR?

Hello experts,

We have a branch in EU and UK

For easier management , just want to have single tenant for both.

Is it possible?

Under GDPR scheme, should I host one tenant for both UK and EU. is it possible?

Which one should I choose??

Thanks

SDG

Resolved! Quarantining files about 300 MB / Hunting big Files

Hello dear community,

what happens with quarantined files, which have 300 MB?

I can't download it from the action center like I am used to.

Yes, I saw they are moved to %PROGRAMDATA%\Cyvera\Quarantine), but can I get it from there?

Would y

...

Resolved! File search and destroy

Hello Team,

We are unable to delete certain file due to the error "Access is denied".

Is there any other way to delete these files.

Cortex XDR_Incident Tagging

Hello All,

Greetings for the day!

I would like to know if there is any way through which we can add the tag in the incidents and alert.

I can see 2 columns available in the alert and incident pane, but not able to edit it with the custom name lik

...

Resolved! True Positive / no incident / evasion / self made alerts helped to detect

Hello dear community,

got an 2 hour infection on a fat client from this https://www.virustotal.com/gui/file/79e3e243726a8b29b4cf74576e364ce98dfadb5bd182d8d1ed55255e70defc2c/details

This little guy was evading cortex xdr pro.

Whatch out and fill y

...

Resolved! Excluding hash for particular machine

Hello Team,

- We have added one of the hash in the block list and it is quaratined.

- In one of the test machine we need this file for testing purpose.

- Is that possibke to exclude this hash from the particular machine?

High medium low severity

Dear Team ,

On what basis high ,medium and low severity alerts/incidents are classified on cortex XDR

Regards,

Shashank

User

Count

User

Likes Count

2 Likes

1 Likes

Cortex XDR Discussions

Discussions