XDR - Printing delay all documents

Hi,
Has anyone had a delay in W11 with Cortex XDR , when trying to print, for example, a PDF
In my case, to print a simple 1mb pdf... edge opens the pdf by default... and when we do CRTL+P, we wait 1 to 2 minutes, until the preview appears and we can p

How to detect Cortex XDR agent stoppage if agent audit logs are being forwarded to SIEM ?

I am currently ingesting XDR agent audit logs to MS sentinel. Is there a way to identify if someone/adversary has managed to stop/disable the XDR agent ? I also want to avoid False positives by filtering out scenarios where the Host itself is powered

ingested data retention - 30 days

Hi guys,

I've purchased PAN-XDR-PRO-GB SKU and i've noticed we get 30 days of ingested data retention and 180 days of incident or alert retention.

Can we keep ingested data for more than 30 days? and/or incident alert retention for more than 180

Local Malware Analysis

Hello,

Could we know the frequency with which the hosts are scanned to identify alerts in local malware analysis module? 

some of endpoints might be exposed to risk due to report-only policies

Dear Team,

While login my Organizational XDR Console, their is attention message display - Image added. 

If you guys having answer Please share to me - Thanks 

Using XDR Asset Inventory and XQL to report of machines without Cortex installed

Hello All

I would like to use Asset Inventory to provide a list of each machine with os Windows and without Cortex agent installed.

The goal is to use the result in a widget for the dashboard if possible. Even better would be an api to use it with

USB Drives Are Blocked - Want to Enable for Certain Endpoints

Hello,

We are very new to having XDR and our onboarding was not very well done. They ended up doing everything on their own and struggling with it all; having mulitple people on the call to show our onboarder how to do things, etc... It was not ver

Cortex XDR XQL Query

Cortex XDR Pro - 8.2.0.46438 - Agents Disconnected - service state "stopping" how to monitor that?

Hello dear community, 

today I ran into some issues with the version mentioned above. I know it got hotfixed, but when you cannot install an upgrade and cannot uninstall the agent, I get challanged 

You need to uninstall it directly after restart,

Cortex XDR VM Broker Cluster and External Load Balancer

Hi All, 

I have 3 Broker VMs deployed in my Google Cloud project and I want to create a cluster from them. I also want to put a load balancer in front of the cluster as mentioned in the documentation "For "active/active" applets that require load b

Querying BitLocker status on a certain endpoint

I am aware of "Disk Encryption Visibility" where we can see the encryption status all volumes under any endpoints. But it appears we can't filter on this field (Volumes Status).

Is there any way at all to programmatically answer a simple question l