Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Resolved! xql query for file \ folder name.

How can I locate a particular file or folder across all endpoints? file or folder name : bihmplhobchoageeokmgbdihknkjbkndThanks community Cortex XDR

Resolved! How to update broker VM IP in the existing XDR agents ?

Hi All We have recently changed the region of our XDR tenant and we have migrated all of our Agents. now the issue is most of our agents were configured using cytool/CMD and support team configured the Broker VM IP manually. As the broker VM IP needs to be changed , i was wondering how to do that now? i didnt find any good documents related w...

Why none of the CVEs on Cortex XDR are from years prior to 2017?

All the CVEs that appear on the platform Cortex XDR date back to 2017, when I see the vulnerability assessment section, none of the CVEs are from years prior to 2017. Could you give me an answer as to why this is so?

Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block

Hello team, Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block ? or how Cortex XDR decide to block/detect the behavioral threat alert? Cortex XDR

Queries about different operating system and the hours of attention to incidents

Hello everyone, I am trying to create some XQL queries to create some dashboards but without success. I wanted to know if you could help me, the questions would be the following: 1. that the different operating systems are shown, but that it shows if the computer is W7, W11, WS2012, WS2016, Ubuntu, MAC, etc. There is a query but it only shows ...

Assistance Needed: Blocking URLs (Google Docs & Gmail, TeamViewer and others)

Dear Support Team, I am writing to request assistance with configuring a policy within in my version of Cortex XDR Pro. As part of the migration process, I need to restrict access to Google Docs and Gmail, TeamViewer and others to ensure the blocking. Any additional information or recommendations you can offer regarding this specific situation w...

Cortex XDR Scanning on Exchange and Sharepoint Servers

Hello, We are looking to add the XDR agent to our on-prem Exchange and Sharepoint servers, and I had two questions about the scanning capabilities of the agent on these servers. Does XDR scan emails and attachments that reside on Exchange servers? Does XDR scan files that are stored on Sharepoint? If an external user posts a document on our ...

Query to Monitor Computer Uptime

Hello, I intend to formulate a new query to retrieve the computer's uptime, and if the system has been active for more than 30 days, generate an alert. Although I attempted the following XQL Search, the outcome yielded no results: config case_sensitive = false | preset = xdr_event_log | filter event_type = EVENT_LOG and action_evtlog_even...

Cortex XDR agent and EICAR malware test file

Hi team, It feels like I'm missing something and so would appreciate of someone could explain to me why the XDR agent on Windows (latest 8.2.1 with block policy) is not reacting to EICAR malware test file (X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H)? I tried malware scan on the file but the agent reported it clean. I fu...

CDL or Strata Logging Service: Tenancy is getting expired in two days, how to renew the tenancy

I have access to an instance of "Strata Logging Service". My tenancy to Strat Logging service is ending by: Jan 25th. Need help in renewing the tenancy . Thanks, Debabani

Firefox Extensions

Hello guys, this is my first post, I'm glad I can be part of this community, I tried to make a query to see what extensions are installed in Firefox. I hope it is ok and useful and if you have something to add to improve it, I would be very happy. config case_sensitive = true | preset = xdr_file| filter agent_os_type = AGENT_OS_WINDOWS | filte...

Resolved! Policy to block the access of Microsoft Store through Cortex XDR

Hello, i would like to know if there is a way to block access to microsoft store through Cortex XDR , i know there are many way to reach this goal such as GPO. but i would like to use Cortex XDR . because it will be harder to manage (remote) out of network users unlike cortex which can be forced almost instantly. any help will be highly appre...

Managing server Option Not Unavailable - Cortex XDR

I am attempting to change managing server option for an endpoint, however the option is unavailable when I go to endpoint control. See image below: I do have endpoint administrator privileges in Cortex XDR Management UI as shown below: The documentation indicates that I should have administration privileges to Cortex XDR in the Hub. I...

Partial protected endpoints

Dears, In some cases Endpoint is going to Partial protected due to some issues. I have read this knowledge base. (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OGWCA2&lang=en_US%E2%80%A9) Now I want to know that How can I get alert about when endpoint goes Partial protected mode. I have checked agent logs. There...

Query users that use USB device

Hello. I've try to obtain a list of all users that use USB device in his computers. All corporate computer have XDR installed, any query suggestion? Regards. Rodrigo

Discussions

Welcome to the Cortex XDR Discussions!

Resolved! xql query for file \ folder name.

Resolved! How to update broker VM IP in the existing XDR agents ?

Why none of the CVEs on Cortex XDR are from years prior to 2017?

Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block

Queries about different operating system and the hours of attention to incidents

Assistance Needed: Blocking URLs (Google Docs & Gmail, TeamViewer and others)

Cortex XDR Scanning on Exchange and Sharepoint Servers

Query to Monitor Computer Uptime

Cortex XDR agent and EICAR malware test file

CDL or Strata Logging Service: Tenancy is getting expired in two days, how to renew the tenancy

Firefox Extensions

Resolved! Policy to block the access of Microsoft Store through Cortex XDR

Managing server Option Not Unavailable - Cortex XDR

Partial protected endpoints

Query users that use USB device

Local Analysis Malware - Signed exe

bioc not prevent

Updating Cortex Agent by MDM

After more than 2 years Linux vulnerability reporting is still useless.

Cortex XDR Pro – Does it scan USB devices upon insertion?

Cortex XDR MITRE ATT&CK v16 -- We're Now on v19. Can We Talk About This?

Re: Suspicious executable detected Microsoft Store Purchase App

Re: Local Analysis Malware - Signed exe

Re: Local Analysis Malware - Signed exe

Re: Suspicious executable detected Microsoft Store Purchase App

Unlock your full community experience!

Resolved! xql query for file \ folder name.

Resolved! How to update broker VM IP in the existing XDR agents ?

Resolved! Policy to block the access of Microsoft Store through Cortex XDR