Cortex XSIAM Discussions | Palo Alto Networks

Welcome to the Cortex XSIAM Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Options to onboard Microsoft Message trace logs into XSIAM

As we have an option in Splunk to see the all the message tracking logs through Microsoft message trace app, do we have any similar app to integrate?Cortex XSIAM

How to exclude a legitimate signed process from Anti-Ransomware Protection (Suspicious File Modification) in block mode?

Hi all, We get a false positive on Cortex XSIAM: Alert: Suspicious File Modification Module: Anti-Ransomware Protection Process: jpconsole.exe (OpenText Blazon), signed by Open Text Corporation, WildFire = Benign It is a legitimate app that modifies many files normally, so it looks like ransomware. We are in Report mode now and want to move to B...

DNS Analytical Logs

Hi Everyone, I need some assistance integrating DNS Analytical Logs into XSIAM. I have tried collecting these logs using an XDR Collector and other available methods, but so far I have not found a supported approach. This requirement is quite urgent, and I would appreciate any guidance from anyone who has successfully integrated DNS Analytical L...

Snippets Test

Cortex XDR Cortex XSIAM Test, more to come.

Resolved! life of a case

Hi all, I am trying to figure out the life of a case and run into a question I can't seem to find the documentation about:What happens when a case has been set to resolved but a new matching issue pops up? Is a new case created or is the resolved case re-opened?

XSIAM Integration Web Server

Hi,I want to create an Integration that start a simple web server with a single button for example that print "Hello World".There is the out of the box integration "Generic Export Indicators Service" I want it to be based on that (With Long Running instance, Nginx etc..)I have tried to do so but I couldnt make it work.Would love to get some help...

Cloud Identity Engine - CIE

Hi, Is anyone using Cloud Identity Engine in XSIAM? How useful is it, and could you share your use case and experience? Thanks

Azure XSIAM

How is on-boarding logs using Microsoft Azure integration different from using the Azure Event hub integration? https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-3.x-Documentation/Onboard-Microsoft-Azure https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Ingest-Logs-from-Microsoft-Azure-Event-H...

IOC Exclusion for when an IOC was denied by the FW

Hi All, so when an IOC is added for an IP address for example in XSIAM, and a FW logs containing this IP is ingested to XSIAM, then XSIAM will auto create an alert for this IOC regardless if dropped or allowed by the FW.. it detect this IOC and creates an alert. has anyone found a solution for IOC not to trigger when the FW action has already...

Resolved! bulk close issues

Hello teamI have the following scenario of 16K open issues and I would like to perform mass closure of these open cases. Is there any way to do this? i tried to build a playbook which i give it the excel sheet of all the issues IDs and start bulk resolve but i have problem with it , it is very slow , i mean it takes 24 hours for just close 4K is...

Crowdstrike Integration to XSIAM

Hi All, We are running XSIAM with the Crowdstrike Falcon content pack installed, the parsing and datamodeling works.. data is ingesting etc etc.. however we are not seeing any alerts being generated as yet.. the content pack does not include a realtime correlation rule to pull and map alerts into xsiam. Has anyone done a custom correlation rul...

Resolved! XSIAM Analytics rules Dashboard

Is there anyway to create a widget used on a dashboard that shows me all the enabled analytics rules in xsiam? Cortex XSIAM

Resolved! XSIAM - Data Patterns

Hi. Please, a question about Data Patterns in Cortex XSIAM. Once the connection from the Broker VM to the Windows server (SMB) is configured, the connection is verified and displayed under Modules -> Data Security -> Storage Buckets, how is it linked to previously created Data Patterns and Data Profiles?. Thank you in advanced. Regards.

Username Generalization Playbook

Hey all, i'm hoping that someone has already started something like this and can get me a few steps past the starting line but as we know, in a corporate environment, there are various ways that usernames come across (abc123, first.last, domain/abc123, domain/first.last, fqdn....etc) from different log sources. This creates complexity for playbo...

XSIAM Content Update Notifications pack

Hi, has anyone deployed this to date and have it working? just started looking at this as a means to notify our platform team when we need to perform content updates etc as we manage a number of xsiam tenants.. and out the box both the playbooks fails, so would imagine some customization is needed. the deployment documentation is sparse at bes...

Discussions

Welcome to the Cortex XSIAM Discussions!

Options to onboard Microsoft Message trace logs into XSIAM

How to exclude a legitimate signed process from Anti-Ransomware Protection (Suspicious File Modification) in block mode?

DNS Analytical Logs