Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Scan stuck on \\?\GLOBALROOT\Device\HardiskVolume2\EFI\Boot\bootx64.efi

Hello, we are using Cortex in a Citrix VDI environment.... Non-persistent VDI.

We installed the agent with the VDI flag on the GoldenImage.

When we perform the imageprep scan, it timeout and on cmd appears to be stuck on this file:

\\?\GLOBALROOT\Dev

...

Resolved! Temporary exception in "Allow list"?

Hello, is it possible to set a temporary exception in "Allow list"?
When you want to make an exception but for a limited time; until an identified date.
Once this date has passed, the rule would be automatically deactivated...

Resolved! strange files: malware?

a random dir /a on a VM that seemed to be struggling produced a list of unexpected files:

07/09/2023  09:28 PM            20,000 ZZZZZ2852017353.doc
07/21/2023  10:10 PM            50,240 !!!!!2729304900.doc
07/21/2023  09:34 PM         3,000,000 XOR

...

Feeding XSOAR Widget with XDR BIOC IOC Quantities

Hello everyone,

I need to get BIOC IOC numbers from XDR tenants. I am trying to create a horizantal bar widget on xsoar like below. Is there any way to get those numbers? Thanks in advance

Resolved! RDPStealer Does Cortex XDR Pro cover this ?

Hello dear LIVEcommunity!

someone know if Cortex XDR pro cover this attack?

RDPStrealer is a stealer that allows attackers to obtain the user's login credentials when trying to contact other machines, thus ensuring their persistence on the network b

...

Resolved! Looking for the ip addresses of Cortex XDR server that sending syslog messages

Dear LIVEcommunity,

I was looking to restrict the firewall rule by only whitelist a certain ip address to reach the syslog server sitting in DMZ.

Cortex XDR is one of application that I need to whitelist so that the syslog messages can reach the sy

...

Broker VM is grayed out in Agent Settings Profile drop down list when I try to add it to Download Source

I have fully configured the Broker VM and activated the Local Agent Settings APP (everything is green and working). The Broker VM appears in the drop down in section Download Source in Agent Settings Profile (that I am editing), BUT it is grayed out

...

Resolved! CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

Hello dear LIVEcommunity!

Should we follow the recommendation from microsoft or does cortex xdr pro cover this CVE?

https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/

Rob

File Disapper

We are using Coretex Paloalto XDR. From yesterday, in one of our application servers, the web.config file automatically disappears. We checked the incedent logs in XDR but no incedent or log found. it happened twice from yesterday .

Regards

Ram

Resolved! XDR on RHEL 10.1.0.2.0

Hi Team,

As per the XDR Compatibility list, RHEL 10 is not mentioned in the list. Can someone confirm if it is compatible?

Regards,

Shahwaz

Simulating "Respond to Malicious Causality Chain" feature

Hello there,

As the title suggests, we are looking for a test we can simulate the behavior (have kali / attacker / victim test environment).

Any suggestions?

Thanks

Are we covered on below Vulnerability by XDR?

CRITICAL - Linux version of Abyss Locker ransomware targets VMware ESXi servers

Links for more information:

https://www.bleepingcomputer.com/news/security/linux-version-of-abyss-locker-ransomware-targets-vmware-esxi-servers/

https://researchsnipers

...

Cannot upgrade The Cortex XDR from 7.2.1 to 8.1.0.41560

Cannot upgrade The Cortex XDR fr

om 7.2.1 to 8.1.0.41560

Resolved! Need Clear idea on XDR action on file

Dear All ,

Once XDR taken action on a set of files which seems to be suspicious . Apart from Wildfire verdict , its also shows XDR action like Detected , Prevented (blocked ) .

How can I confirm Actual Action by XDR is Quarantine / Cleaned / Del

...