Where to publish EDL

Hi, I was planning to use Cortex XDR as my EDL publisher but since it doesn't support networks, only single IP addresses, it is useless for me. I don't want to publish it on our IIS servers so I'm looking for good alternative. Can anybody suggest something?

how I add exclusion based on for an specific process (license.exe) for specific endpoint

Hi family How I add an exclusion based on for a specific process allow (license.exe) for specific endpoint on cortex xdr. wildfire are blocking this process many times so i want to allow for this service for specific endpoint. thanks, and regards.

is there a way to pass the password to cytool via cmd?

let say I want to run protect disable on 100 computers.... I tried the following but didn't work: C:\PSTools>psexec -i -d -s \\pc100 cmd /c echo 5Nstall22#| "c:\program files\Palo Alto Networks\Traps\cytool.exe" protect disable5Nstalll22# is the pass.... thank you!

Cortex XDR_Behavioral threat detected (rule: excel_virus)

Hello All, Greetings for the day! We are getting multiple high severity alerts/incidents related with excel files because of Behavioral threat detected (rule: excel_virus). Within the time span of 4 hours we have received 28 high severity alerts in 12 different hostnames. Also, the high severity alert is getting generated for the newly cr...

Cortex XDR Alerts not appearing in the Admin Portal under Incidents >Alerts?

Hi all, Recently we've been experiencing some alerts (which we believe to be false positives) but are unable to see these alerts in the admin portal. Is there any configuration required to generate Admin Portal alerts in the Alerts Table? Or should they all appear there by default? We have profile configurations and I've seen the following o...

create a tag in fireall

"Hi, We have multiple VM brokers, each connected to the same model of firewall. However, in a recent incident, it was difficult to identify the source of the incident from which the firewall it originated. We're exploring two potential solutions: 1. Is there a method to create tags on the firewall to distinguish the source?2. Alternatively, is t...

Is there any logs for cortex XDR that can help with the multicast traffic issue?

Send alert from Cortex XDR via MS TEAM

Dear all, I'm planning to deploy Cortex XDR on my DC, but I don't see the integrated options for MS Teams. Could I know whether or not I can send alerts from Cortex XDR via MS Teams?

Can global uninstall password expire?

We noticed that the global uninstall password set last year at the end of May no loger works, in the Management Audit Logs there are no other events "Agent global uninstall password updated". Can it expire? or be changed without generating an event in the audit logs?

Regex Not Functioning Properly in XQL

Hello everyone, I'm attempting to extract fields from DHCP logs but encounter an error stating, "Your query failed to run as it's invalid." my regex code works correctly on regex101 and CyberChef. Does anyone have any insights on how to troubleshoot the issue? dataset in(infoblox_infoblox_raw )|filter _raw_log ~=".*dhcpd.*" |alter event_raw = _...