Verify default policy and custom on Cortex XDR

Dear Support,

I would like to open case for verify and confirm on these tasks below:

+ Currently we use this default rule on Cortex Prevention Policy Rules for customer that just enable it as protection mode but customer concern it’s not best practice

Alert Not Stitching (Custom Correlation Rule)

Hello everyone, I have a question about alert stitching in Cortex XSIAM/XDR. I created two correlation rules:

1. Policy - Violation Root Detection (Medium severity)

2. Policy - Successful Sudo Command (Low severity)

However, when I check the incidents,

Best practice for installing agents on Windows "multi-session" Azure AVD?

Which method should be used to install the Cortex XDR agents for the Azure-only Windows 11 multi-session VDI? Since it's both a terminal server, and a non-persistent VDI that gets re-imaged from a golden image?

Reminder: Stopping attacks with AI-Powered Endpoint security starts in an hour

Hi,

I registered for an event Stopping attacks with AI-Powered Endpoint security starts in an hour from Palo Alto Networks Events - Palo Alto Networks. Now when I tried to login today it said work email failed although I was registered

So please

Cortex XDR Role permissions

What role permissions are needed to view CIE and Access Management section in XDR? I set all permissions to view mostly but the user assigned to the role cannot see the CIE and Access Management section under "configuration" in XDR

Cortex XDR 

How to run a specific file or process on an endpoint using Run Endpoint Script

Hello!:)

I'm looking for a way to run a file or process by identifying it if the endpoint hasn't used a specific file or process at the client's request.

I tried the following, but it didn't work well.
1) Run calc.exe using Powershell
2) Create a

Maximum telemetries data that can be stored offline

Hi team

Is there a cap for how much telemetries data can be stored offline? Or does it simply depend on how much disk space is available?

I am wondering if an agent has stayed disconnected for an extended period, would it be able to upload all telem

VDI flagging as "Standard" install type

I am not our virtual infrastructure guy, but he is stating that the VDI=1 flag is set on the golden image, however, the column "Installation Type" in the console is showing standard.

Has anyone else every had this issue? Normally I wouldn't care ab