Applications hanging on terminal server since Cortex XDR Pro rollout

Hello dear community, 

what is your expirience with slow applications when printing, saving documents (not responding) on a terminal server?

Yes, there are over 30 users on it and it was a bit slow before cortex xdr pro rollout. But now it is terri

Logs not visible - XQL Query

Hello,

Currently we are trying to create a query that gives us the result if the user has executed Sudo command and then right after executed the cd command. Is it possible to write a query that searches for commands executed one after the other?

Login details in Cortex XDR

Hello,

We are trying to create a quarantine policy for machines that are not connecting to the console, so we are checking if NAC solution can fetch these details and based on that policy can be created. And also, where (file path or file name) can w

rare iptable delete command

We received couple of alerts on rare iptable delete command.On checking the host activity, we could able to observe all commands including newly entered command in the host machine but not able to see the iptable delete/flush command in the activity

Integration between CDL and Rapid7 InsightIDR not working

I am working on the integration between CDL and R7 IDR SIEM and this is not working. I don't get pass the test connection on CDL. 

https://docs.rapid7.com/insightidr/palo-alto-cortex-data-lake/ 

https://docs.paloaltonetworks.com/cortex/cortex-dat

Log BrokerVM license has expired.

We receive an alert Management Audit Log: Broker VM XXXXXXXX license has expired - Deactivating applet XXXX.

I'm not sure about this log, someone please help suggest us.

Cortex XDR 

Execute a program in my endpoint from live terminal Cortex XDR

Hi everyone, 

has anyone tried to execute a program in an endpoint from live terminal? I mean, when you are in the endpoint you can use a command like c:\notepad.exe in cmd and it opens notepad, I want to do the same but from the live terminal, I t

Cortex XDR folder exclusion - for Mac-Clients

How do i put a Folder on a Mac-Client in the Malware-Policiy-Profile into the Allow-List?
For Windows-Clients, thats no big Problem, the Path always gets delivered with the Incident, but for Mac, the Path does not seem the Case, or, at least, i cannot

Active Scanning on Endpoints

Hello,

We intend to perform scheduled scanning on all endpoints. So we wondered if active scanning was required on all endpoints repeatedly, or if cortex developed its own scan whenever a new file was created or added to the system.

Cortex Filter on MacOS prevents internet connectivity

Hey everyone,

We're having some issues with the most recent Agent Version on MacOS (7.9.0.2505).

When some of our clients were upgraded to this version they suddenly lost internet connectivity. The only thing that worked for them was to remove Co