how to suppress the prompt "Cortex XDR" would like filter network content"

Showing results for 
Show  only  | Search instead for 
Did you mean: 

how to suppress the prompt "Cortex XDR" would like filter network content"

L1 Bithead

for the Macs, how does one configure Cortex to suppress the display of this prompt (see attached), and just automatically use 'Allow'.


Ive tried calling up, but I don't see an obvious key pair where this behavior might be controlled.



Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

L3 Networker

Hi @Houston29115,


Thanks for posting to our Live Community board. 


As per the Cortex XDR Admin Guide the network content filter requires user approval. Can be suppressed in your MDM profile. You can also suppress this operating system prompt by uploading a configuration file provided by Palo Alto Networks.
Let me know if you have any questions or concerns!
Silviu-Mihail Dascalu

still seeing the network filter pop up. 


Does the unified profile contain code to supress this popped? If so, specifically which key pair(s)? 


I'm using the code within the "CortexXDR_UnifiedConfigProfile_Intel_V3_SignedPANW.mobileconfig" from your own company website. If I open the file, then copy paste, it seems to work except for the content filter repeatedly popping up and asking to "allow" it. Dont wont to have to rely on my users to make the correct choice...




L1 Bithead

ran Beyond Compare text comparison tool to compare the "Unified" and "Content Filter" code - looks like there is definite overlap. So is the Content Filter code really required? In any case, either using both profiles or just one - scoped to a single test machine - nothing Ive been able to do causes the Content Filter to auto choose "Allow" and auto-suppresses its display. Same for the Notifications badge. We don't want users making choices here, thus the need to silent auto install...


Hey Houston,


Did you manage to find a solution? We've just experienced a larger outage due to pushing the Unified profile to multiple devices with users pushing "Don't allow", which caused their devices to completely lose network connectivity.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!