Analytic BIOC Rules, right click open in query builder, informational severity not available

We have a support ticket open for "informational" analytic BIOC rules that are not alerting.

These do not show up in the incidents or alert table, but the number of alerts in that column has more than 0

Support has indicated there is not a way to view

Palo Alto Cortex XDR exclusions/exceptions use case example article for solving VPN agent interoperability issues

Hello to All,

I have made an interesting article about Cortex XDR use case for using isolation exclusions/exceptions when having VPN agent that blocks network traffic based on DNS FQDN Domains:

https://live.paloaltonetworks.com/t5/general-artic

Test File Post_Detection

Hello everyone, 

I am searching for a test file, which gets Post_Detected by XDR. 
I can´t find an official test file from Palo, maybe somebody in here has one. 
I will run this on a lab so no worries. 

Kind regards,

Marinus

ssh logins on linux servers

Hello,

How do we identify ssh logins on linux servers?

Regex Help Event ID 4720

Im attempting to get out the email address listed as User Principal Name in a 4720 event ID

Any help or explanation would be appeeciated

dataset = xdr_data
| filter action_evtlog_event_id = 4720
| alter User_Name = arrayindex(regextract(action_evtlo

Cortex XDR Pro - Tag capability in Asset Management

Hello dear PA community! 

It would be helpful, when there would be a possibility to tag an IP in Asset Management. We would like to enter the real Asset behind it. 

They have fixed IPs and we would like to have a chance to work with it. 

BR

Rob

Deploy Broker VM

Hello,

Is there any document regarding the steps to Deploy Cortex XDR Broker VM through VMWARE ESXI.

Cortex XDR as part of the golden image

• How can we include Cortex XDR as part of the golden image? (for the agent installation on Windows)
  • Condition:- It shouldn't create any duplicate entries on the console.
• Will there be a new entry on the console if the admin changes the system hostname

Cortex XDR 3.5 - Whitelist UI

Hello,

How Legacy Exceptions are different from Policy/profiles in Policy management.

Cortex XDR installed on personal computer which was used for work more than 5 years ago

Hi,

Hi have this personal computer which I used for work several years ago (5). I started working for another company and stopped using this computer for work stuff.

Recently, about a year ago, I started using it again for all kind of things (str