This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4396 Views
  • 0 replies
  • 3 Likes

Masquerading - 4203898100

We're getting this alert whenever we're trying to install filezilla.exe or Opening Filezilla.exe. We're using the same installation file like before and also tried with the latest versions. But still it's getting blocked by XDR. Any idea why is that happening? We used filezilla before and we didn't have this issue before. Cortex XDR

Disable Protection Rule for Remote Initiated Behavioral Threat

We are creating a custom service to handle automatically checking and updating programs (similar to PDQ Deploy, or an RMM tool). We've signed the the created service and tried several ways to disable it from being blocked. The problem is, we are very limited in what we can target with the disable prevention rules. Has anyone run into this and a...

CJNTS_5-1708639694767.png
CJNTS_2-1708639146320.png
CJNTS_0-1708639964650.png
CJNTS_3-1708639258518.png
CJNTS by • L2 Linker
  • 2995 Views
  • 2 replies
  • 4 Likes

Error code:307 on MAC, Cortex Agent 8.2.1

I get a "Cortex XDR Policy update failed!" messageError code: 307 This happens on a MAC (updated). I'm also unable to uninstall the agent. I was able to do it once, then installed it again, and now my tennant's global uninstall password doesn't work. This is kind of a deadlock, and i have 3 more MACs which disconnected from the tennant, de...

CFriacas by • L0 Member
  • 3712 Views
  • 1 replies
  • 0 Likes

Data Lake Activation Button

Hello, I have Cortex Pro per GB license of 165 GB. I have also bought Cortex Data Lake. When I go to Support Palo Alto--> Products--> Assets tab, I can see Data Lake and its Auth Code. But when I go to https://apps.paloaltonetworks.com/apps , I see no activate button under Data Lake: I want to integrate PaloAlto firewall with XDR and s...

JahidAliyev_0-1708693524066.png
JahidAliyev_1-1708693647357.jpeg

Resolved! Software Inventory query

Hi, I'm using following query to get software inventory and it is working well. However to the results, as last column, I would like to add number of hosts which have particular software. Could somebody advise how to do this please? dataset = host_inventory | arrayexpand applications | alter software = json_extract(applications, "$.applicat...

Cortex Visio Stencils

I am making customer diagrams for Cortex XDR, XSOAR, and the data lake. I can easily find hardware visio stencils, but nothing for Cortex. Does anyone know where I can find Visio stencils? This link has nothing: https://www.paloaltonetworks.com/company/press-kit.html

Resolved! Cortex XDR Data Lake

Hi, can you answer to this question? If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance. Palo Alto Networks will provide the customer with a free instance. What size is this free Cortex Data Lake instance? a. 1 TB b. 10 GB c. 100 GB d.10 TB

XQL Query Assistance

Hi all, I'm new to Cortex and creating XQL queries. I was looking for a way to detect a brute force attack (failed logins followed by a successful login). Are there any good resources available online or can someone help me get this query built? Thanks in advance#Cortex XDR

Resolved! Agent interface display language

Hey All, has anyone had to ever "set" a default language for the agent interface for a select group of users? Ideally, I would like to flip all endpoints from a specific location to French. If this is NOT possible, is there a way to set the language from install? Thank you,Joe

Parsing rules

Hello, I am sending Cisco Asa logs to Cortex XDR and XDR automatically creates parsing rule of "Ingest". When I am searching for "cisco_asa_rules" in query, I got a field named "raw" which contains detailed format of log: That is a detailed format of raw field: --- <116>Feb 16 2024 05:54:25 firepower : %FTD-4-430003: EventPriority: L...

Resolved! Windows Anti-Malware Scan Interface (AMSI) and Cortex XDR

Hey community, I'm curious if anyone's had experience with integrating AMSI with Sharepoint servers and how Cortex XDR works into all of that. I am curious also, if AMSI needs to be enabled or if it's recommended to be disabled. Any current configuration documentation I find references Microsoft Defender and we've disabled that running XDR alo...

CraigV123 by • L3 Networker
  • 7331 Views
  • 3 replies
  • 0 Likes
  • 2611 Posts
  • 98 Subscriptions
Top Solution Authors
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks