Microsoft Defender Outbound traffic policy

Trying to slim down a rule for outbound traffic with clients using MS defender. I built a custom URL list of the defender urls provided by MS. Added it to the policy under service/url category. The apps used are ms-update, ssl, web-browser, windows-d

Multiple bogus credentials on GP portal

I have noticed there are alot of random IPs that are trying to login to my GP portal. We are using pre-login method of GP so legit users do not login. GP starts and does an auto-login pre-windows login. The logs tell me these failures are coming from

Intermittent inet connectivity after updating to 10.2.8-h3

We're currently running on 10.2.3-h9 (PA-440's in HA pair Active/Passive) with remediation steps put in place for CVE-2024-3400 and Telemetry disabled. 

We attempted to migrate to 10.2.8-h3 as it is listed as a preferred release and fix for the CVE a

ION1200-s routing between SVI

I am unable to route between SVIs configured on an ION-1200s. Is there something that we're missing with configuration?

Can ping within SVI (device on SVI subnet can ping its GW)

Can ping SVI GW to SVI GW

Device on one SVI cannot ping GW of another

PBR using Route failover

Hi All,

Our organisation purchased two Mpls link and wants to configure an PBR like such

1) All intranet traffic like dns, ntp shoud go via primary MPLS

2) All internet related traffic should go via Secondary MPLS

3) In case Primary MPLS goes dow

TSF file upload

I am trying to open a case in the portal for one of our customers and the page is not working.  I have a TSF to upload as I believe our customer has evidence of exploitation of CVE-2024-3400

Creating a ServiceNow incident by taking the Slack user responses

Hi All,

We have a requirement to create a ServiceNow ticket by taking the slack user responses.

I have built a playbook which does send the SlackBlockBuilder to the specified Slack channel but the playbook runs only when an incident is attached to it

Creating a Queue on Slack Integration

Hello all, 

I am working with Slack from the playbook level where a message summarizing an incident is sent followed by Slackask automation to ask users on a channel to confirm the information with two interactive buttons. Take note that the flow has

Cortex XDR Pro licensing models

Hi everyone!

Please, could anyone point to a document or page that has all the Cortex XDR Pro licensing models?

Thanks in advance.

Cortex XDR

Move Cortex XDR agent from one tenant to another (and back)

When we move an agent to a new management server, what would happen to the logs and telemetries we have on the old tenant? Would they be retained as per the usual policy or would they just get purged?

Also if we then move it back to the old tenant,

XSOAR - GET-GPO DisplayName

Hi,

I've created a playbook to analyze some alerts related to SOC and GPO, but the alerts come with ObjectGUID and I need to convert the GUID to DisplayName.

In PowerShell, the command is simple: (Get-GPO -Guid "$GUID").DisplayName.

I tried running

XDR - Unable to clear user's APPDATA

Unable to clear user's APPDATA...for tshoot (application upgraded) we need delete all files and folder on users APPDATA , but the system prevent this.

I try stop services and delete files/folders, but not work.(XDR create a incident - Suspicious Fi

False Positive (GitButler)

All versions of GitButler are falsely flagged by Cortex XDR.

The corresponding GitHub issue can be found here: https://github.com/gitbutlerapp/gitbutler/issues/3518

The hash is related to version 0.11.1

Component: WildFire
Cortex XDR code: C040005

Panorama fails to upgrade itself with error: Label sysroot1 does not indicate a valid image

Hi all,

      last time I tryed to upgrade my Panorama, I had this error: "Label sysroot1 does not indicate a valid image".

The panorama is working, also I'm able to upload images and content to managed firewall, only I cant upgrade itself.

Is not re