XDR policy targeting using AD

[HafisM]

Hi there,

When we are trying to target a policy using AD group some of the listed endpoints is not a member of selected group.

To get more clarity we selected a group which only contains users and even then the result listing some random endpoints.

Is it normal behavior or am I missing something here

how can we target policies using AD groups and can we do policy targeting on user level ( for Device control policy)  

Thanks

Hafis

[jcandelaria]

Once you create the Profile under Endpoint Management > Policy Management > Extentions Profile then you can now attach the profile to the policies in Extention

guide: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/apply-sec...

In step 6: You can use the Active Directory filter column to select target endpoints (assuming your directory sync is setup and working properly).

guide: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr...

If you are using the Active Directory column when filtering a target and its not detecting the right endpoints, you can submit a case so we can further investigate it.

[HafisM]

Thanks for reply jcandelaria, 

It seems we have some issue within the directory sync

Will raise this issue with PaloAlto.

Thanks