Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Resolved! Agent script Library

Hello,

I would like to know if a script to that invokes live terminal or other functions related to Cortex XDR can be done using agent script library.

Resolved! Intense SSO failures

Hello everyone,

Recently after the update we started getting errors for SSO that say Intense SSO failures.
While investigating execution chain, I only ran into outcome reason as "Strong authentication is required or device authentication failed".
Is the

...

Linux operation mode (Pending)

Dear All,

I wanted to create a widget to display the details of Linux Operation Mode, can someone help me how I can start with, I am still a rookie in XQL Query.

TIA

Agent Blocking files/processes dynamically based on conditions

Hello XDR Enthusiasts,

I am working with multiple XDR Tenants and would like to block a file/process based on conditions. I understand that you can use the Prevention features to block files based on a block/black list. This can also be configured on

...

Detect critical assets without agent

Hi,

I need to create an alert everytime asset with tag critical has no xdr agent installed, it is outdated, disabled or disconected.

Regards,

Fábio

Resolved! Vulnerability Assessment - missing CVE?

How fast are these CVEs being updated?

This one is missing in our list:

https://nvd.nist.gov/vuln/detail/CVE-2023-23415

BR

Rob

Outlook stops syncing with Cortex XDR enabled

We have 2 Cortex tenants with a total of about 600 users. We encountered an issue where Outlook 365 will show "Needs password" and will not connect to Office 365 to sync. The only way to get it to sync is to stop the Cortex service. Once Outlook conn

...

Resolved! Disable Scheduled Scans on non-persistent VDI machines

In our environment we are using Cortex XDR. We are at the point where we want to start looking at maybe installing this on non-persistent virtual desktops. I found the documentation that talks about how to install on the master image but there was al

...

Will Cortex XDR also checks for rogue/malicious browser extensions & blocks them from adding ?

also how to get visibility into the browser extensions used through Cortex XDR ?

Top 10 Incidents in Last 30 Days

There is one Top 10 Incidents widget provided in Dashboard builder which provides list of top incidents in last 24 hrs only, can anyone help me how to get data for last 30 days. Cortex XDR

Resolved! Cortex XDR - Brute force alert rule

Hi,

I need to create a brute force rule.

When endpoints with tag "CRITICAL" has "action_evtlog_description = An account failed to log on" and has more than 50 logs, create a CRITICAL alert.

Could you help pls.

Regards,

Resolved! Enable Endpoint File Scanning Documentation - Clarification

Hello -

On step 16 of Add a New Malware Security Profile (Prevent), there is a note:

We recommend that you disable scheduled scanning. VDI machine scans are based on the golden image and additional files will be examined upon execution.

I'm assum

...

Automation of Reports

Hello Team,

We need to create automated XDR report to detect executions of “Python.exe” and “PowerShell.exe & PowerShell_ise.exe” in our environment.
Can we query a incident/alerts to make a report or suggest us how we can generate reports based on

...

Resolved! Get info from different dataset and compare

Hi,

I need to get failed logins from critical assets.

So I was trying to get tag "CRITICAL" in endpoints dataset and if there are any "event_type = ENUM.EVENT_LOG and action_evtlog_event_id = 4625 in xdr_data dataset.

Could you help pls