Cortex XDR Live Terminal problem

[OrkanAlibayli]

Hello.

We have a problem about live terminal. When we we initiate live terminal session in endpoints ( all endpoints have same problem ) notification pops up ( about live terminal ) but we see 'operation time out' error in Cortex XDR web UI. Can anybody help about this situation?

Note:  We give all accesses to endpoints as mentioned in this link.

Thanks.

[eluis]

Hi OrkanAlibayli,

please check this doc with the requirements for the live terminal session and make sure you are compliant with that

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

at the following document you will see how to at step 4 you can disable the notifications to the user. Please realize that this is just available for Windows and Mac endpoints. 

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/customiza...

I also hope that the following procedure helps: 

Procedure
To investigate and respond to security events on Windows endpoints, you can use the Live Terminal to initiate a remote connection to an endpoint.

The Cortex XDR agent facilitates the connection using a remote procedure call.
Live Terminal enables you to manage remote endpoints.
Live Terminal is supported for endpoints that meet the following requirements:

• Traps 6.1 or a later release
• Windows 7 SP1 or a later release
• PowerShell 5.0 or a later release
• Windows update patch for WinCRT (KB 2999226)—To verify the Hotfixes that are installed on the endpoint, run the system info command from a command prompt.
• Endpoint activity was reported within the last 90 minutes (as identified by the Last Seen time stamp in the endpoint details).

If the endpoint supports the necessary requirements, you can initiate a Live Terminal session from the Endpoints page. You can also initiate a Live Terminal as a response action from a security event. If the endpoint is inactive or does not meet the requirements, the option is disabled.

After you terminate the Live Terminal session, you also have the option to save a log of the session activity. All logged actions from the Live Terminal session are available for download as a text file report when you close the live terminal session.

Please dont forget to thumbs up if this answer was helpful.

KR,

Luis 

[OrkanAlibayli]

Hello Eluis,

Thanks for answer. All requirements in above is compatiable in our endpoints. But problem still going on. 

[WSeldenIII · Accepted solution]

Hi @OrkanAlibayli 

Palo Alto Networks is currently reporting Cortex XDR  - Limited Functionality in Remote Terminal Services in Americas and Europe Regions.  You may subscribe to the updates to monitor the status.