Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

CrowdStrike XDR Use cases with Pala Alto Cortex

Hi Team, Can you please suggest a few case studies where CrowdStrike XDR is integrated with Cortex SOAR and what were the areas and use cases that were implemented and helped the customer? We wanted to present this to a management that already has crowdstrike XDR and we want to showcase how cortex SOAR can help.

Cortex XDR Periodic Endpoint Scanning schedule

We have a new compliance requirement to Perform periodic scans of the system at least every 72 hours and real-time scans of files. We currently have the schedule set to scan weekly. But I do not see the option to scan more frequently. Is there a workaround to increase the frequency of periodic scanning? Cortex XDR

Resolved! [Cortex XDR] - What is the difference between Cortex XDR Pro and Prevent License?

Hi Everyone, What is the difference between the Cortec XDR Pro and Prevent licenses? Does Prevent collect data? What is the difference between the data collected by the two licenses? Thank you.

Cortex XDR Agent for Linux with 1 GB RAM and 1 CPU

Hi, I have a customer with linux machines with few resources. There is any agent to Linux machines with only 1 GB RAM and 1 CPU? Regards, Fábio Ferreira

Cortex XDR Blocked Trend Micro Services [TmCCSF.exe]

Dear All, Suddenly Cortex XDR blocked Trend Micro Apex One Services [TmCCSF.exe]

Resolved! Cortex XDR agent with linux agent as server type

Hi, I have installed agent in several linux machines, but all are being categorized as Server Type and some are workstations. Since I am using dymanic groups, what should I do to "fix" this? (Windows are OK regarding server type and workstations type) Regards, Fábio Ferreira

Resolved! How to add Windows DHCP logs to enrich Assets data

Hi Everyone, I am totally new to Cortex XDR and trying out the latest Pro version. What I wish to do is simple and I saw others discussed about it. But I really really need clear instructions on how to do that. In the All Assets list, we wish to get more information about assets that don't have XDR agent installed, besides their IP addresses. It...

Resolved! XDR Prevent to Pro

Does anyone even use Prevent anymore besides us? 😋 Our budget's been approved to hopefully upgrade our license structure to Pro during Q1 of next year. Does anyone have any recommendations / tips / suggestions or whatnot to make this migration a success? We're supposed to get some assistance from our marketing and P.A. engineering team whic...

Resolved! Rename Tenant URL

Hi Community We would like to change the URL of a Cortex XDR tenant to newname.xdr.eu.paloaltonetworks.com and then use the old URL oldname.xdr.eu.paloaltonetworks.com for a new tenant. How long do I have to wait with the tenant activation until the URL is released for use again? Thanks & Best Regards

Resolved! Advanced API monitoring profile.

Hi Team, We need some clarification. We've enabled Advanced API monitoring for Windows. Could you please let us know if this functionality is also available for Linux and Mac?

Resolved! Cortex XDR Pro Per GB License

Hello： Does anyone know if XDR Pro Per GB license can operate alone?If I only want to analyze Firewall events, can I just buy a Per GB License?Is there any documentation that can explain this? Thank you

XDR - Printing delay all documents

Hi,Has anyone had a delay in W11 with Cortex XDR , when trying to print, for example, a PDFIn my case, to print a simple 1mb pdf... edge opens the pdf by default... and when we do CRTL+P, we wait 1 to 2 minutes, until the preview appears and we can print.The machine has a lot of free resources (memory cpu etc)...I think the cortex is analyzing s...

How to detect Cortex XDR agent stoppage if agent audit logs are being forwarded to SIEM ?

I am currently ingesting XDR agent audit logs to MS sentinel. Is there a way to identify if someone/adversary has managed to stop/disable the XDR agent ? I also want to avoid False positives by filtering out scenarios where the Host itself is powered off. Cortex XDR

ingested data retention - 30 days

Hi guys, I've purchased PAN-XDR-PRO-GB SKU and i've noticed we get 30 days of ingested data retention and 180 days of incident or alert retention. Can we keep ingested data for more than 30 days? and/or incident alert retention for more than 180 days? is there any SKU's for that? Thanks Cortex XDR

Resolved! Policies at risk - how to accept these?

Hello dear all! How can I accept the risk of policies, which would be needed somewhere in the future? I do not want to delete them. Just accept the risk. BR Rob