Multiple Queries regarding cortex XDR

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Multiple Queries regarding cortex XDR

L3 Networker

Hello, 

Is it possible to know the following :

        1. Whether BIOC rules generate alerts/incidents in case there is a match for Custom prevention rules.

        2. Any method to bulk hash blocking using Action center.

        3. If we are hosting XDR firewall simultaneously, can we host another firewall from other tools . 

 

3 REPLIES 3

L5 Sessionator

Hi @Shashanksinha the answers are

1. Yes

2. Yes you can enter multiple entries in one go using Action Center

bbarmanroy_0-1669276150635.png

Alternately, you can also use API's as that eliminates the need to copy-paste one at a time. You can then leverage the ability to ingest multiple entries, one at a time, each with their own comments.

3. You can take a look at the list here and see if this meets your requirements (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/external-data-ingestion/abo...).

Hello, 

Thanks for the response . 

I wanted to ask instead of adding one-by one .Is there any method to upload it through some sheet without copy-pasting one by one 

Like we can add IOC in the XDR console in bulk uploading notepad file or csv file . 

 

Hi @Shashanksinha that's not possible now. The workaround is to use the API via a programming language or scripting language of your choice or use the Cortex XDR Postman API collection to perform the same.

Take a look at the detailed walkthrough of how to configure Postman to do the action you're asking for. 

bbarmanroy_0-1669284163296.png

 

Ref: https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-postman-api-collection/ba-p/443845

 

  • 1099 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!