This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XDR
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all Palo Alto Networks products in one place.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex XDR

Welcome to the Cortex XDR LIVEcommunity! Explore how-to guides, best practices, and on-demand videos to help you get the most out of Cortex XDR. Have questions or insights to share? Join the conversation in our Discussions forums and connect with our Product Experts.

Stay in the loop—subscribe now to get the latest product updates delivered to you.

Blogs

Beyond Playbooks: A Deep Dive into the Cortex AgentiX Case Investigation Agent

07-30-2026 — Go beyond rigid playbooks with the Cortex AgentiX Case Investigation Agent. Discover how context-aware reasoning, native XQL generation, real-time telemetry, and enterprise-grade guardrails help security teams investigate faster while maintaining ... — Read more

Labels: Cortex AgentiX Cortex XDR Cortex XSIAM custom-featured-post
686 1 by in Community Blogs

Architecting Autonomous SecOps: Cortex AgentiX

06-09-2026 — Attackers are using AI to speed up data exfiltration by up to 4X. Discover how Cortex AgentiX transforms traditional SOAR into a spectrum of autonomous reasoning with domain-specific AI agents, native Model Context Protocol (MCP) integrations, and... — Read more

Labels: Blogs Cortex XDR Cortex XSIAM Product Features
2261 3 5 by in Community Blogs

Code Less, Do More with Cortex AgentiX

05-29-2026 — Use natural language to build scripts for your playbooks and agents. This fourth video in our series shows you how to prompt our Automation Engineer to build you scripts or troubleshoot existing ones. No more coding from scratch. Let the Automatio... — Read more

Labels: Cortex AgentiX Cortex Cloud Cortex XDR Cortex XSIAM
735 by in Community Blogs

Using AI Prompts in Cortex AgentiX

05-29-2026 — This third video in the series covers best practices for building AI prompts in Cortex AgentiX. Learn how to optimize the prompt, test it and save it in your prompt library for reuse in playbooks or agents. — Read more

Labels: Cortex AgentiX Cortex Cloud Cortex XDR Cortex XSIAM
761 by in Community Blogs

Building Your First Agent in Cortex AgentiX

05-29-2026 — This second video in our series goes over how to build custom agents in Cortex AgentiX. Learn how to give an agent a "job description", specific actions and permissions. Here’s how to build your AI dream team. — Read more

Labels: Cortex AgentiX Cortex Cloud Cortex XDR Cortex XSIAM
954 by in Community Blogs

View All

Digital Learning Courses

Access Palo Alto Networks learning platform to gain technical insights and educational materials across our full suite of products.

Please note: SSO login is necessary to access the content.

Videos

06-26-2024 — Cortex XDR Customer Success Webinar: Threat Hunting Methodologies

05-30-2024 — Cortex XDR Customer Success Webinar Series Part 2: Alert Tuning Use Cases

04-24-2024 — Cortex XDR Customer Success Webinar Series Part 1: Alert Tuning Fundamental

03-27-2024 — Cortex XDR Customer Success Webinar Series Part 3: Improving Application Security with Parsing & Correlations

02-28-2024 — Cortex XDR Customer Success Webinar Series Part 2: Correlation Rules - The Core of Detection

View All Videos

Discussions

Need answers? Register or Sign-in to Engage, Share, and Learn.
Author Topic Views Replies
tlmarques
tlmarques
08-27-2026

XDR Alert Dump – Finding the File That Triggered the Alert

I have a question. When we perform a Dump Alert and get the ZIP file, how can we analyze it in more detail? For example, if I want to see the .ps1 fil...

posted in Cortex XDR Discussions

58 1
R.Abdeen
R.Abdeen
08-27-2026

Low Incident

We have integrated Cortex XDR with Elastic SIEM. Our SOC process currently creates a ticket for every Cortex XDR incident/case, including Low, Medium,...

posted in Cortex XDR Discussions

80 1
SeanDeHarris
SeanDeHarris
08-26-2026

Create an issue when FIM events detected

Hello experts, We plan to get the FIM module on top of my XDR. Having set up with FIM Profile and Policy, we could be able to see those events succ...

posted in Cortex XDR Discussions

73 1
tlmarques
tlmarques
08-26-2026

XDR agent reboot recover everytime

Hi guys, Recently, we identified several computers running Cortex XDR version 9.2.0.120 with Content Version 2340-38788. After the machines start, con...

posted in Cortex XDR Discussions

64 0
tlmarques
tlmarques
08-26-2026

Non-Persistent VDI – File Collection and Investigation with XDR

Hi everyone, I need some help/advice. I’ve been seeing some cases on non-persistent VDIs where we receive alerts such as “Script Engine Activity - 312...

posted in Cortex XDR Discussions

37 0
Join now
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks