LIVEcommunity is undergoing site maintenance. We apologize for any inconvenience.
01-08-2025 07:32 PM
The Forensic investigations feature in Cortex XDR truly impressed me; it saves me a lot of time collecting evidence during investigations. But why does Cortex XDR only support Forensic investigations for two platforms, Windows and macOS? Windows is common, but why macOS, and not Linux and its popular distributions like Redhat, CentOS, Ubuntu? Most servers run Windows and Linux, and many investigation cases are also conducted on Windows and Linux. So why did the developers choose macOS instead of Linux?
Will they support the Linux platform in the future?
01-15-2025 08:52 AM
Hi @D.Tran166255 ,
Thank you for writing to live community!
While it will be very difficult to answer the "WHY" aspect of your query, I would definitely like to highlight this to you that Palo Alto Networks Cortex XDR roadmap of innovation is very much driven on customer feedbacks and upvotes. While Windows and macOS footprints in the world are way larger or equivalent in terms of usage, their footprint of common end user usage is more, which essentially expands the attack surface area in this direction. This does not imply that linux/unix systems are agnostic of attacks and there is not a need of a linux forensics collection, but we can assure you that our product engineering and R&D is dedicated for enhancement in this direction as well.
Please consider reaching out to your accounts team or customer success teams to raise/upvote the feature to introduce forensics for linux and that should be the direction to have the feature.
Hope this helps
01-15-2025 08:52 AM
Hi @D.Tran166255 ,
Thank you for writing to live community!
While it will be very difficult to answer the "WHY" aspect of your query, I would definitely like to highlight this to you that Palo Alto Networks Cortex XDR roadmap of innovation is very much driven on customer feedbacks and upvotes. While Windows and macOS footprints in the world are way larger or equivalent in terms of usage, their footprint of common end user usage is more, which essentially expands the attack surface area in this direction. This does not imply that linux/unix systems are agnostic of attacks and there is not a need of a linux forensics collection, but we can assure you that our product engineering and R&D is dedicated for enhancement in this direction as well.
Please consider reaching out to your accounts team or customer success teams to raise/upvote the feature to introduce forensics for linux and that should be the direction to have the feature.
Hope this helps
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
