This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 4489 Views
  • 0 replies
  • 3 Likes

File scanning.

Hey All, question for you. What process does an XDR agent follow when a user opens a simple .pdf or .docx file? I am trying to find something basic to explain this to one of our Executive Managers who is concerned that the agent is causing common apps like Adobe Reader and Word to open slowly. Appreciate any info you can offer. Thank you, Joe

Resolved! Requesting Clarity on XDR XQL API Logging (timeframe related)

Hello Team, We are using XQL to query data from cortex API for windows event logs. Our query run every 5 minutes and we have used parameter timeframe in the query. This parameter is provided in the API documentation. However, when we pull the logs, there is discrepancy in number of logs we pull and number of logs observed in Cortex XDR search....

Resolved! Upgrade agent fails

Hi team I am trying to update an agent but it shows me "the installer has timed out" on the logs, I checked upgrades logs and I see the next message "Distribution ID is missing from installation package" I thought that it could be an issue related to agent installer but they exists on the console. Has anyone had a similar problem? Thank you!

MarcoMJ by • L1 Bithead
  • 10830 Views
  • 5 replies
  • 0 Likes

Resolved! Cortex XDR Incident integration splunk tool

We are currently integrating the Cortex XDR incident logs with the Splunk tool. Currently, the incident logs are visible in the Splunk tool, but certain essential fields required for conducting an XDR log investigation are not available in the existing logs. These necessary fields include File Name, File Path, File Hash, Command Line, Grand Pare...

Resolved! Difference between host_inventory and endpoint in XQL Query

Hello, I'm trying to search for all installed vpn on endpoints using an XQL Query. Before going further in my query, I'm trying to list all hosts where the application name contains "*vpn*". This result and the result from host insight doing the same search are different. Somes endpoints are not showing in the query. So I've tried to search ...

Resolved! Cortex XDR: Bitlocker Monitoring

Hello everyone, We are looking at using XDR to monitor Bitlocker status on Windows machines. On the 'Disk Encryption Visibility' page, we can see the Encryption status, but there is no way to filter on 'Unencrypted' drives. - Does anyone know of an XQL Query to show only the drives unencrypted? - Does anyone know of an XQL Query to tie to a BIOC...

PBurns_0-1626116899345.png
PBurns by • L1 Bithead
  • 6740 Views
  • 3 replies
  • 0 Likes

Resolved! Cannot delete endpoint group

I want to delete a static endpoint group and get this message:CANNOT DELETE GROUP Please note that this group is defined as an endpoint scope in the user permissions Remove all references to this group before deleting.I checked for scope references in user permissions and found none. Am I missing something here?

PC-TomS by • L3 Networker
  • 3355 Views
  • 4 replies
  • 0 Likes

Incident scoring rules

Dear LIVEcommunity, Our environment had the SMART score enabled and now I'm working on incident scoring rules to make the VIP username and/or their devices stand out when alert generated matched their username/hostname. I had their information flagged as "featured user/host", Am wondering what the recommended scoring structure would be. Kind...

EU GDPR and UK GDPR?

Hello experts, We have a branch in EU and UK For easier management , just want to have single tenant for both. Is it possible? Under GDPR scheme, should I host one tenant for both UK and EU. is it possible? Which one should I choose?? Thanks SDG

  • 2632 Posts
  • 99 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks