Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Password spraying

Hi,Could you provide an XQL query to detect password spraying, specifically when the same IP address attempts logins on multiple AD accounts?Thank you.

Limitations Observed with XQL Custom Widgets and Issue Visibility

Hi, We are facing multiple limitations while creating custom widgets using XQL, which are impacting our dashboard visibility and operational efficiency. The details are outlined below: Auto Refresh LimitationWhen creating a custom widget using XQL, there is no option to configure automatic refresh intervals. Currently, the widget refreshes onl...

Resolved! BIOC with IPV6

Hi, I can't create BIOC with IPV6 query, please any idea? BR

Cortex XDR Broker VM content cashing verification

Dear All, I have added the self signed certificate (certificate generated in linux and verified by AD) in broker VM, I did not receive any error, but need to verify if the content cashing is working properly? How can I verify if the content cashing is working or not?

Resolved! Know executable file

Hi, Please, any idea to known executable from Microsoft Office Ex: .docx file with XQL query. Best regards.

Resolved! TELAM SERVICES IS STOPPED - CORTEX XDR

Hi everyone, I am looking for in-depth technical details regarding the telam service within the Cortex XDR agent architecture. I've observed that this service handles the local machine learning analysis for executables, but I often see it in a "Stopped" state during runtime queries. Could anyone clarify: Role & Impact: What exactly happens...

XDR 4 - Integrations AD Query

Hi everyone, on Cortex XDR 4 ,we can build small playbooks, and one of the available actions is AD Query.My question is: what is required to configure this integration? I see that the integration asks for the IP address, domain user, and other parameters, but if the Active Directory is on-premises, how does Cortex XDR establish the connection?Wh...

identify for MS Office processes that write an executable file with BIOC or XQL

Hi, Please, I want to identify for MS Office processes that write an executable file(s) with BIOC or XQL. Best regards.

Resolved! Cortex XDR - How do I open a new feature request?

Can you tell me if the website for opening a new feature request is available? If so, could you tell me the URL path to open a Cortex XDR feature request? Cortex XDR

Advanced Authentication Cortex API

Does anybody have any examples of how they have implemented Advanced Auth for the Cortex APII only have PowerShell available examples using that that would be preferred, but I can probably interpret most scripting languages.If not examples, maybe links to articles discussing the process to implement it more generally.Cortex XDR

Resolved! Cortex XDR manager upgrade

Hello, In October, our XDR manager console displayed a pop-up window regarding "Cortex XDR 4.X is now available" with the possibility to upgrade before end of February 2026. We did not choose to upgrade at that time. How can we upgrade now ? Can we do it alone or it require a support case ? Thank you for your help. Thomas

Playbook to enrich dataset data into alert context

Hi, Is anyone able to guide me on how to achieve this perhaps? I want to ran a task in a playbook that will do a custom query in a dataset and pull information and add it to the alert context data.. is this possible and if so guidelines would be appreciated. thanks in adv

Cortex XDR – Unable to Assign Read/Write Permissions for Mobile Device (Detected as CD-ROM) in Permanent Exceptions

I am working on a Cortex XDR Device Control configuration and I need to allow a specific mobile device only for file transfer from the endpoint to the device, but I do not want to allow any data transfer from the mobile device back to the endpoint. However, I noticed that the device is detected as a CD-ROM device type in Cortex XDR (1.ss). When ...

Want to use Cortex XDR Agent Cleaner but cant log support as licenses expired

Hi all, My XDR portal has expired and i want to use/test the Cortex XDR Agent Cleaner as part of my role. Can i access this tool elsewhere, or can i use my support for my other Palo products to request this?

Install XDR agent for unmanaged PC in remote users

hello experts, we got users who is work from home. no IT support, looking for a way to install XDR agent for users. using teamview or anydesk?? any experience to share? Thanks SdG

Discussions

Welcome to the Cortex XDR Discussions!

Password spraying