how to suppress the prompt "Cortex XDR" would like filter network content"

[Houston29115]

for the Macs, how does one configure Cortex to suppress the display of this prompt (see attached), and just automatically use 'Allow'.

Ive tried calling up com.paloaltonetworks.cortex.app.plist, but I don't see an obvious key pair where this behavior might be controlled.

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[SilviuMihailDascalu]

Hi @Houston29115,

Thanks for posting to our Live Community board. 

As per the Cortex XDR Admin Guide the network content filter requires user approval. Can be suppressed in your MDM profile. You can also suppress this operating system prompt by uploading a configuration file provided by Palo Alto Networks.

Let me know if you have any questions or concerns!

Thanks,

Silviu

[Houston29115]

still seeing the network filter pop up. 

Does the unified profile contain code to supress this popped? If so, specifically which key pair(s)? 

I'm using the code within the "CortexXDR_UnifiedConfigProfile_Intel_V3_SignedPANW.mobileconfig" from your own company website. If I open the file, then copy paste, it seems to work except for the content filter repeatedly popping up and asking to "allow" it. Dont wont to have to rely on my users to make the correct choice...

[Houston29115]

ran Beyond Compare text comparison tool to compare the "Unified" and "Content Filter" code - looks like there is definite overlap. So is the Content Filter code really required? In any case, either using both profiles or just one - scoped to a single test machine - nothing Ive been able to do causes the Content Filter to auto choose "Allow" and auto-suppresses its display. Same for the Notifications badge. We don't want users making choices here, thus the need to silent auto install...

[AdminVavtar]

Hey Houston,

Did you manage to find a solution? We've just experienced a larger outage due to pushing the Unified profile to multiple devices with users pushing "Don't allow", which caused their devices to completely lose network connectivity.