Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

XQL query to retrive endpoint data from data lake

Can anyone help me how to retrive endpoint logs from data lake via XQL

Resolved! Correlation rules and BIOCs

Hi, What correlation rules and BIOCs created manually do you suggest? Regards, Fábio Ferreira

Cortex Agent Best Practice Customization for Terminal servers & DC Servers

Hi, Is there any Cortex agent customization suggested or best practice docs for Windows Terminal servers and Windows DC Servers

Cannot remove/install xdr agent

Hi everybody !I would like to find out how to download the XdrAgentCleaner.exe to remove cleanely old xdr cortex agent ? We have several computers on which we cannot uninstall the old agent, you will find the message attached. I have already follow these steps without success :https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-4/cortex-xdr-ag...

How to remove Cortex without Management

Existe uma forma de forçar a remoção do Cortex 7.9 do ambiente que eu não tenho mais senhas de gerenciamento ou remoção, já que o parceiro rescindiu o contrato e não forneceu o mesmo.

Resolved! Broker VM connection issue

Hi Community We're facing an connection issue with Endpoints using Broker VMs (agent proxy). We opened a TAC case, but it's stuck. There is no useful help yet. - Endpoints are isolated from the internet (no direct or webproxy access)- Endpoints are registered in Cortex, but doesn't get content updates- Live terminal to endpoints is not possibl...

Integrate the BVM server with SIEM

Hello Team, We need to change rsyslog.conf file. Please let us know if this file can be changed and is it recommended to integrate the BVM server with the SIEM?

Cortex XDR 8.1 not installing on Windows Server 2008 R2/2012 windows 10_v1607

Hi,We've a problem with installation cortex xdr 8.1 on Windows Server 2008/2012 and Windows10_v1607....All machine need the AZURE update https://support.microsoft.com/en-us/topic/kb5022661-windows-support-for-the-azure-code-signing-program-4b505a31-fa1e-4ea6-85dd-6630229e8ef4 We read the documentation, try install updates but errors every time...

IOC Feed upload via API / disabled IOC overwrite / reactivate

Hello dear community, is it possible not to overwrite disabled IOC with API Upload? If the indicator is disabled, it should stay disabled. But atm it isn't like that, the indicator is beeing deleted, written into the ioc table and get's activated again. Is this adjustible? BR Rob

Resolved! Generate private & public keys for broker VM

How to generate private and public key pair for accessing DR broker VM and let us know how to use the key pair to access the BVM.

Resolved! Cortex XDR Prevent to Pro

Hi, ill soon have to migrate a customer from prevent to pro. My question is i heard, that Palo just has to change the license in the background and that would be all i just have to enable the pro feature in the policy. My only concern is, that the client wont work cuz its currently prevent and i dont want to have to reinstall the client on all...

Linux audit logs

Hello , How can we check on XDR who is logging in on Linux systems ?

Create Cortex XDR rule exclusion with specific time

Hi community I wonder if are there any of you who succeed/ever experienced creating Exclusion Rule in Cortex XDR but the rule will only be applied if the incident occurred at a specific time. As I read Palo's documentation and dig down into the community, I haven't met the case that matched mine. If there are any documentation links or solutio...

Resolved! A question from the Cortex XDR What's New in 3.7 webinar: Alert Trigger

I tried reg and cmd lines with bcdedit options to set safe mode. They didn't trigger an alert. Also booted into safe mode and didn't trigger. What is the trigger? This question was asked as part of the Cortex XDR Customer Success Webinar: What's New in 3.7

Resolved! The query is w.r.t API operation

Hello, Is the API function available to run the "File Search" operation? --> (“Incident Response --> Action Centre --> File Search- Sha256”). Did not find this option in the Cortex XDR API documentation, however, wanted to confirm and check if this can be achieved through API or not?

Discussions

Welcome to the Cortex XDR Discussions!