Cortex XDR Discussions

Alerts and incidents

Hello Palo Live Community.
Does anyone know what are the criteria that Cortex XDR takes into account to create an incident for a single alert? This is because I have seen that some alerts do not necessarily form an incident, but in other cases, yes. I

...

XQL query for incident report

I like to get a hint how i can build simple xql query for overtime timeframe for incidents. I need to filter that data, but that kind report that i can show example monthly base report for customer. where there are data for each day

XQL Query Help

I'm trying to write a few XQL queries in Cortex XDR, but I’m quite new to it and running into some difficulties. I’d really appreciate any guidance or examples you can provide for any of the following queries:

To detect when the Cortex XDR Agent is u

...

Cortex XDR agent on Domain Controller

Dear all,

May I have a chance to find with you palo guidelines regarding Cortex XDR agent installation on Domain Controller.

Any comments ?

Resolved! XQL Query Help

I am trying to create a rule for the case of creating a new user in the admin role. Where's my mistake?
I am grateful for your help.

dataset = xdr_data
| filter action_evtlog_event_id = 4720

| alter Direct_Role = arrayindex(regextract(action_evtlog_me

...

Resolved! An endpoint with the Cortex XDR installation intermittently creates a huge file and writes to the hard drive at C:\Windows\System32\PaloNull

Dear Live Community Members,

One of my customers noticed that some endpoints with the Cortex XDR installation sometimes creates a huge file that grows in size with time.

On several VMs equipped with the Cortex Agent (version 7.7.1, but we also noti

...

high priority 'Behavioral Threat' alert for smss.exe (system)?

Every few weeks or so getting a high priority alert:

'Behavioral Threat' generated by XDR Agent detected on host <some_WS2019_server> involving user system

Priority: High
Behavioral Threat
Source: XDR Agent

Behavioral threat detected (rule: sync.vul

...

Resolved! Cortex XDR Prevent and "Identity Analytics" Module - licensing confusion

Good day, I am running in circles trying to figure out whether or not I have the access to the "Identity Analytics" module. I'm looking to alert on several Kerberos related alerts, and a few of them require this detection module. Is this module inclu

...

Resolved! Retetion Time - cortex xdr

Hi, I want to know what is the retetion time for the incidents in the cortex xdr tenant.

After how long are the console incidents cleared?

thank you

Resolved! create BIOC rules via Cortex XDR API

Hi community,
I'd like to enquire whether Cortex XDR can create BIOC rules via Cortex XDR API.
I could not find any description about creating BIOC rules on the following Cortex-XDR-API-Reference.

Cortex XDR API Overview | Cortex XDR (stoplight.io)

Problemas de compatibilidad Broker OVA con VCLOUD

Saben si el formato de OVA del broker es compatible con VCLOUD o en que formato lo tendria que generar para poder montarlo?

Resolved! block vulnerable applications from running

Hi community,

I am attempting with restricting the execution of vulnerable applications.

Is it possible to block a specific application version using BIOC associated with restriction profile?
(Or if there's another easy way to do this please let m

...

managing incident from dynamic emails using MSGRAPH integration

Hello everyone,

I am looking for a solution to handle a specific situation related to incident activation from an email, using the MSGRAPH integration.

Typically, to activate an incident, I classify it based on a static email subject. Then, I configu

...

Discussions

Alerts and incidents