Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.
Hello ,
Wanted to know if XDR has the capability to view network packets (pcap) or to push out network policies, block traffic, visualization of network data etc.
My goal is to determine which device/user has used Sanctioned and non-Sanctioned cloud storage, e.g., Onedrive, SpiderOak, NextCloud, Syncthing.
There is a feature in Microsoft Defender for Cloud Apps that i'm hoping to find in Cortex, which contains
I'm attempting to pull out the name, type, and value from the dns_resolutions data
The below query results in "FAILED TO RUN QUERY" with no data, removing the alters does return data however no fields available return "value" in the dns_resolutions
...
Hi everyone,
I have a doubt
how can I check the status of the cortex xdr service / agent in linux?
Thanks in advance.
greetings.
Hello, is there a way to compute the Mean Time to Acknowledge (MTTA) and Mean Time to Respond (MTTR) statistics of all the cases ?
thank you in advance
Does anyone have a script how to update Cortex on a MacOS with Bash ?
Can I disable the Cortex XDR on anyone of the endpoint(workstation or server) for temporary purpose from the XDR Console.
Hello,
Is it possible to know the following :
1. Whether BIOC rules generate alerts/incidents in case there is a match for Custom prevention rules.
2. Any method to bulk hash blocking using Action center.
3. If we are hosting
...
Is there a way we can identify cluster and namespace details for k8's and not just nodes and containers
I'm trying to block domain across in our environment. I don't want to use url filtering on PA FW, but I want to use XDR IOC to block it. is possible to do it?
Hello dear community,
As you know, weekends and on holidays the priority of alerts rises.
Is there a way to trigger in XQL Rules which are only fired on weekends and on self selected holidays?
Like on weekend anybody who opens powershell trigg
...
We intend to perform scheduled scanning on all endpoints. So we wondered if active scanning was required on all endpoints repeatedly, or if cortex developed its own scan whenever a new file was created or added to the system.
Are there any talks about Cortex XDR support for Windows 11 ARM?
