Cortex XDR - Endpoint/Incident API Limit (100) - PowerBI Query

I am attempting to pull in endpoint/incident data using the appropriate API in PowerBI. However, there's a limit of 100 . I tried adding a separate custom column anticipated that my total number of incidents would be let's say "x" value, but that jus

Best way to exclude legitimate behaviours

When it comes to excluding legitimate behaviours from BIOC rules, as far as I can see, there are 3 options:

1. Modify the BIOC rule itself adding "not equal to" logic.
2. Add BIOC rule exclusion at https://<organisation>.xdr.eu.paloaltonetworks.com/rules/exc

Discovering unprotected devices

Has anyone come up with a reliable method to report on devices without xdr running on it? 

Join two data sets XQL

Before I get into my failed script, please allow me to explain what Im attempting to do.

We are looking for windows and Macintosh devices with cortex xdr agent NOT installed.  To do this we installed the cortex DHCP log collector. It is reporting its

Cortex XDR Prevent Specific Questions

We are using Cortex XDR Prevent 

1) I see many places the word 'rules' and 'rule exception' is used , I assume this option or feature is not available in Cortex XDR Prevent as I do not see it in the menus/blades .I guess its a 'Pro' edition feature .

Modify Alerts Going to An Endpoint Group

Hello all,

I have setup an endpoint group of high profile laptops.  I would like the following configured on XDR.

- Prefix all Incident names going to endpoints in that group with "VIP Endpoint [Incident Name] (e.g. VIP Endpoint Wildfire Malware Dete

Rocky Linux

Hi,

do you any plan to bring Cortex XDR on Rocky Linux 8 ?

thx

How most decisions are made by Cortex XDR ?

Greetings ,

I am using Cortex XDR Prevent and keen to know how most decisions are made by Cortex XDR about File/process/macro being malicious or not ?  So assume there are no Hash exceptions and need to know if below is true :

- First Wildfire cache i

Malware Scan for Linux OS

I know that Malware Scans are not currently available for Linux OS. Just wondering the reason for that, and if there are any future plans to enable malware scans for Linux devices?

Mac XDR network content filter, keeps disconnecting and reconnecting

Every 10 seconds, it goes offline and rejoins the network. Anyone see anything like this? 

Seems to be affecting everything connected form the mac machine(s). Latest version of XDR agent..

Cortex XDR incidents view by module

Hi

I am not able to view incidents viewed by modules.

So I want specific to see all incidents detected/blocked by Behavioral Threat module.

Anyway to view this 

/Jacob