Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

XDR Analytics BIOC

Hello Team, How can we create exception for XDR Analytics BIOC incidents?

XQL Stacked Graph

Hello everybody, I need to create stacked graph similar to the one on Ingestion dashboard (Daily consumption). The graph should have DNS query name on X axis and total count on y axis. But at the same time, I need to have the column separated by DNS_query_type. I have a data in a table, but I'm not able to create a graph of this type, can you pl...

Resolved! File search and destroy

Hello, In some cases, when we try to delete files using hash/path, file deletion fails due to "Access Denied". What could be the reason for the deletion failure?

the endpoints Disconnected in my tenant Cortex XDR

I have a number of cases where the tenant equipment is disconnected from our cortex xdr,There was a tenant change recently and equipment from any of them became disconnected for no apparent reason. I tried brute force connected but it didn't work. Any solution for this

Resolved! Forensics - Data Collection [A question from a Cortex XDR CS Webinar]

Do I have to collect forensic data all the time? it's sufficient to ingest data just after an incident? *Note: This question was asked during the Cortex XDR Customer Success Webinar: Uncover the Power of Forensics - Part 1

Resolved! Data Exfiltration / Large file uploads

Hello community, I was wondering if anyone found an efficient query to look for data exfiltration/large file uploads? I'm looking more from a threat hunting perspective, where I would want to trace one or multiple file being uploaded to a remote destination. Right now the only way I've found is to correlate file read actions in the same timefram...

unable to install XDR on windows server

Hi Team, We are getting this error while installing XDR on a Windows server - The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2502 Can someone pls help to resolve this issue? Thanks Shahwaz

Cortex XDR compatibility with MacOS Sonoma (14.0)

Is there a new Cortex XDR being released soon for compatibility with MacOS Sonoma (14.0). I have a team testing this OS and the current version 8.1.1.2594 isn't compatible.

Resolved! Create notification/alerts for failed upgrade and outdated endpoint

Hello, I would like to be notify when an endpoint is outdated or when an upgrade failed. I'm aware there is the notifications pages, LIVEcommunity - Notification if Cortex XDR agent fails to upgrade - LIVEcommunity - 531271 (paloaltonetworks.com) But there is not the filter that I want. I want this only on a specific endpoint group name / t...

Resolved! Cortex XDR IOC Incidents Query

Hi Team, We have detected several IOC incidents in the Cortex XDR console. The action status for these incidents is marked as 'detected,' but upon further investigation, we found that the internal network team had prevented these incidents in the Palo Alto firewall. Simultaneously, when we checked the Cortex XDR console's IOC incidents debug a...

What does Action: Detected (Sinkhole) really mean??

We received a notification with Action:Detected (Sinkhole). What does it really mean? Did Cortex XDR blacklist it? Blocked it? I can't any information on what these Actions mean in the Administrator guide.

Resolved! XDR on Kali Linux

Hi All, Can we install XDR on Kali Linux? Regards, Shahwaz

Resolved! External Application - Fowarding incidents generated in XDR to Microsoft Sentinel

Hello, Currently we are sending all the incidents generated in XDR to Microsoft Sentinel and a new incident will be created in Sentinel. When we close an incident in XDR console, we are closing that incident in Sentinel manually. We would like to know, when the incident in XDR is closed, can the corresponding incident in Sentinel be closed aut...

Resolved! Cancel bulk scanning in progress

How to cancel a bulk scanning initiated which is showing in progress state. Even "cancel for pending endpoint" is also no longer working.

Cortex XDR Incident Report

Looking for a way to create a report that shows how long it is taking our analyst to close an incident. I have read elsewhere it is not possible since the data is not exposed to xql. Does anyone know how to create something that would show how long an incident is open before closing? I have looked at the widgets in the report library but not...

Discussions

Welcome to the Cortex XDR Discussions!

XDR Analytics BIOC