This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4496 Views
  • 0 replies
  • 3 Likes

Cortex XDR Scanning on Exchange and Sharepoint Servers

Hello, We are looking to add the XDR agent to our on-prem Exchange and Sharepoint servers, and I had two questions about the scanning capabilities of the agent on these servers. Does XDR scan emails and attachments that reside on Exchange servers? Does XDR scan files that are stored on Sharepoint? If an external user posts a document on our ...

ldonahue by • L0 Member
  • 2090 Views
  • 1 replies
  • 0 Likes

Query to Monitor Computer Uptime

Hello, I intend to formulate a new query to retrieve the computer's uptime, and if the system has been active for more than 30 days, generate an alert. Although I attempted the following XQL Search, the outcome yielded no results: config case_sensitive = false | preset = xdr_event_log | filter event_type = EVENT_LOG and action_evtlog_even...

Cortex XDR agent and EICAR malware test file

Hi team, It feels like I'm missing something and so would appreciate of someone could explain to me why the XDR agent on Windows (latest 8.2.1 with block policy) is not reacting to EICAR malware test file (X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H)? I tried malware scan on the file but the agent reported it clean. I fu...

stig_72 by • L1 Bithead
  • 10866 Views
  • 2 replies
  • 0 Likes

Firefox Extensions

Hello guys, this is my first post, I'm glad I can be part of this community, I tried to make a query to see what extensions are installed in Firefox. I hope it is ok and useful and if you have something to add to improve it, I would be very happy. config case_sensitive = true | preset = xdr_file| filter agent_os_type = AGENT_OS_WINDOWS | filte...

SorinP by • L0 Member
  • 1633 Views
  • 1 replies
  • 0 Likes

Resolved! Policy to block the access of Microsoft Store through Cortex XDR

Hello, i would like to know if there is a way to block access to microsoft store through Cortex XDR , i know there are many way to reach this goal such as GPO. but i would like to use Cortex XDR . because it will be harder to manage (remote) out of network users unlike cortex which can be forced almost instantly. any help will be highly appre...

Managing server Option Not Unavailable - Cortex XDR

I am attempting to change managing server option for an endpoint, however the option is unavailable when I go to endpoint control. See image below: I do have endpoint administrator privileges in Cortex XDR Management UI as shown below: The documentation indicates that I should have administration privileges to Cortex XDR in the Hub. I...

brownchris_1-1706110978705.png
brownchris_2-1706111104164.png
brownchris_3-1706111851861.png

Partial protected endpoints

Dears, In some cases Endpoint is going to Partial protected due to some issues. I have read this knowledge base. (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OGWCA2&lang=en_US%E2%80%A9) Now I want to know that How can I get alert about when endpoint goes Partial protected mode. I have checked agent logs. There...

Server Golden Image with RDS

Hello, I need your help. We have a Windows server 2022 with active RDS features and it's a "Golden Image", meaning it serves as the image for 6 other servers. My question is... the server's purpose is to be an RDS (providing apps), should the Cortex XDR client be installed as VDI or TS?

tlmarques by • L4 Transporter
  • 1958 Views
  • 1 replies
  • 0 Likes

Resolved! Cortex XDR Linux Service Explanation

Dear Team, I wanted an explanation on the cortex XDR services present on the Linux machine and their role. Needed to know each service functionality mentioned in the below command section like pmd , analyzed , dypd and decryptor.json Name PID User Status Command pmd 20798 root ...

Threat Hunting Scenerios

I would like to set the alert to detect the following scenerios How can I config the XQL/Query in BIOC to detect: Cortex XDR Login of local admin user (user with local administrators privilege) Stop of a windows service e.g “abc.exe” while the endpoint can still be ping or alive Change the status of Cortex Agent, e.g. from protected to unpro...

  • 2635 Posts
  • 99 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks