This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSIAM Discussions
Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSIAM Discussions
Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.
About Cortex XSIAM Discussions
Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.

Discussions

Start a conversation

Welcome to the Cortex XSIAM Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 3020 Views
  • 0 replies
  • 0 Likes

Broker-VM cluster with BVMs on different platforms

Hi All, waiting on official confirmation from PAN on this.. but has anyone to date done this? where you have a bvm in Azure and a bvm on-prem (esxi) and clustered them together? doable? i have concerns around hardware failure and the arp cache being cleared amongst other things.. thanks in adv

PA_nts by • L4 Transporter
  • 6 Views
  • 0 replies
  • 0 Likes

A month-Old Issues Triggering a Case Now

Hello Community, We have identified several cases where the associated issues are showing dates from August. Has anyone encountered similar behavior? Could you please share your insights on the possible cause of this scenario.

S.Edwin by • L0 Member
  • 176 Views
  • 1 replies
  • 0 Likes

Need help in validating XQL query to identify suspicious MFA registration from new GEO location + new device

dataset = okta_sso_raw| filter (debugContext contains "New Geo-Location=POSITIVE" and debugContext contains "New Device=POSITIVE") and (eventType in("user.mfa.factor.activate", "user.lifecycle.create", "system.import.user.create"))| alter user_id = if(eventType = "user.lifecycle.create" or eventType = "system.import.user.create", json_extract_sc...

XSIAM VPN Analytics

How do i get third party vpn logs to work with the xsiam analytics rules (https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-vpns). These are vpn products for which xsiam doesn't have an in platform data model rule so I would have to create one. I need to know how to create one so that the analytics rules...

Cortex XSIAM/XDR - Java File Examination conflict in Policy

Hello Team,"We have observed that every agent upgraded to version 9.2.1.285 on Citrix devices (VDA, MCS) changes its status to "Partially Protected" after the cyserver restart.As the number of devices falling into this status has been increasing, we have temporarily modified the policy to prevent further upgrades on these systems until the issue...

Resolved! XSIAM HTTP Log Collector Testing

Hello everyone, We are currently considering to us a HTTP Log Collector. However, before this can be started, I wanted to test the collection. Now, in theory, this should not be hard, due to the examples provided after setting up the integration. Nonetheless, either the Python Example is faulty in some way, or I am being exceedingly stupi...

Firefox crashes when opening xsiam tenant

Just gauging if just me or anyone having similar issues since a few days now.. suspect after either Windows or FF update recently. Everyone else in FF is fine.. just not XSIAM. Edge works and forced to use it now 😞 When I log into a XSIAM tenant ( i have multiple) via FF, it loads then crashes with following message: 'Gah. Your tab just cras...

PA_nts by • L4 Transporter
  • 224 Views
  • 1 replies
  • 0 Likes

Resolved! XSIAM logs from Palo Alto Firewall using syslog

https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector Why does the official guide only highlight Custom Formats for Traffic, Threat, URL, and File data logs? What about other NG...

TrendMicro Apex One Alert mapping into XSIAM

Hi All Has anyone done this to date and willing to share their Correlation XQL logic used to map alerts from Apex One into XSIAM? I have done this for a few others already like Crowdstrike, MS Graph API etc but having issues with time to navigate through all the raw log data to determine the required fields to validate and alert on what is requi...

PA_nts by • L4 Transporter
  • 258 Views
  • 0 replies
  • 1 Likes

XSIAM documentation in PDF form

Is there any spot where I can just download the documentation for the "admin" guide or the XQL reference that isn't just printing the web page to a PDF? Trying to use the new search function which forces the AI agent is not a pleasant experience for me.

Crowdstrike Integration to XSIAM

Hi All, We are running XSIAM with the Crowdstrike Falcon content pack installed, the parsing and datamodeling works.. data is ingesting etc etc.. however we are not seeing any alerts being generated as yet.. the content pack does not include a realtime correlation rule to pull and map alerts into xsiam. Has anyone done a custom correlation rul...

PA_nts by • L4 Transporter
  • 596 Views
  • 4 replies
  • 0 Likes

Broker-VM disconnet alert notification

Hi All, anyi dea how i can generate an alert when a broker-vm gets disconnected? Has anyone managed to create a correlation rule that will alert if a Broker-VM gets disconnected from XSIAM? the xsiam documentation states that 'To help you monitor your Broker VM version, connectivity, and high availability clusters, Cortex XSIAM sends notifi...

PA_nts by • L4 Transporter
  • 1858 Views
  • 5 replies
  • 0 Likes

Resolved! XSIAM - API Get Correlation Rules - Least Priviledge

In the API reference, it states that you must have Instance Administrator permissions to run the endpoint /public_api/v1/correlations/get. Is it possible to create a custom role for the API key that has sufficient permissions to execute this endpoint? Do you know any other way to retrieve the query from a specific correlation rule? Cortex XSI...

  • 187 Posts
  • 45 Subscriptions
Top Solution Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks