Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

License

Hello, I know that when we buy cortex xdr prevent and pro per GB license, it comes with default data lake. But we cannot access this data lake from HUBs as we did in the past. And, I know that we can but Data Lake for Prisma and IOTs. But I wonder can we buy a data lake wwhere we can access from Hubs and see XDR logs and data (including in...

prophaze waf Log Ingestion in Cortex XDR Management Console

I kindly request how to ingest prophaze waf Logs in the cortex console. If possible, could you guide how to proceed with this integration? Additionally, please share any related documents or resources that could be helpful in this process.Cortex XDR Cortex Data Lake Me too

We config WEC in broker vm in that we followed every confi but we rea getting below erro

19/01/2024 11:31:34 209 Information The Winrm service started successfully19/01/2024 11:31:34 208 Information The Winrm service is starting19/01/2024 11:31:33 212 Information The Winrm service was stopped successfully19/01/2024 11:31:33 211 Information The Winrm service is stopping1...

Data Ingestion License Violation

After our Cortex XDR tenant was upgraded to 3.9 we started receiving the following error: "License Violation warning Based on a 7 day average calculation from February 24th 2024 to March 1st 2024, your daily ingestion quota is exceeded." Looking at the Data Ingestion Dashboard it appears our NGFW data ingestion is reporting to has significantl...

Data Lake Activation Button

Hello, I have Cortex Pro per GB license of 165 GB. I have also bought Cortex Data Lake. When I go to Support Palo Alto--> Products--> Assets tab, I can see Data Lake and its Auth Code. But when I go to https://apps.paloaltonetworks.com/apps , I see no activate button under Data Lake: I want to integrate PaloAlto firewall with XDR and s...

Cortex Visio Stencils

I am making customer diagrams for Cortex XDR, XSOAR, and the data lake. I can easily find hardware visio stencils, but nothing for Cortex. Does anyone know where I can find Visio stencils? This link has nothing: https://www.paloaltonetworks.com/company/press-kit.html

Resolved! Ingest DHCP logs using XDR collector

Hi, I am having issues with ingesting DHCP log from our DCs. We are using the XDR Collector app. I suspect that the issue is with the filebeat.yml file but cannot figure out what the problem is. I have tried and followed the guide below and copy-paste the example code but no logs are showing up. The yml has been checked and the syntax is corre...

Your Cortex Data Lake integration with Cortex XDR is about to expire

We received a Cortex XDR email with the message: "Your Cortex Data Lake integration with Cortex XDR is about to expire. To avoid any data loss, it is recommended that you copy your device configurations directly into Cortex XDR" There was also a similar warning message that had a link to manually migrate which took me to Configurations > Da...

Cortex Data Lake integration with XDR Expiration.JPG

XQL query to retrive endpoint data from data lake

Can anyone help me how to retrive endpoint logs from data lake via XQL

DTRH: CIS Benchmarking - 3rd Party Data Ingestion | Data Parsing | Widgets & Dashboards

DTRH: CIS Benchmarking 3rd Party Data Ingestion | Data Parsing | Widgets & Dashboards Overview In this DTRH we will look at adding valuable data into XDR from performing CIS Benchmarking across systems. Even outside of CIS Benchmarking data, customers are looking to bring data (telemetry, alerts, logs, …) into the Cortex Data Lake and XDR ...

Resolved! Why is Cortex XDR not included under Palo Alto Hub Gateway Apps?

Hi, I'm curious as to why the Cortex XDR Data Lake is under PA Hub Gateway Applications, but Cortex is not. Thanks

Resolved! Firewall logs to Cortex Data Lake log buffering

Hello, For firewalls managed with Panorama there's a setting in Panorama "Buffered Log Forwarding from Device" which tells the firewall to buffer it's log in the case of loss of connectivity with Panorama. Does anyone know if there is an equivalent feature when sending logs from firewalls to Cortex Data Lake? I'm not seeing anything in docum...

Block logs to Data Lake from specific endpoint

Hello, I have a case where logs are delivered to Data Lake from endpoint were we're unable to uninstall Cortex XDR agent. We also can't connect to this endpoint to take manual actions to stop receiving logs from it. Is there any way to block/prevent these endpoint uploading logs to the Data Lake? From my knowledge, we could implement Exclusion...

DTRH: Scripting Anything and Reaping Data

DTRH: Scripting Anything and Reaping Data Overview Customers are always asking for additional capabilities in the product and often times these feature request may come during a POC where having that capability can be the deciding factor in winning the deal. The feature request to delivered into the product can be a long cycle, often time you ...