XQL query search for "Connection Lost" computers

Hi,

I'm trying to find a query which will show me computers with status "Connection Lost".

Sadly I'm not able to do this in both preset = host_inventory  (can't find the computer which has this status in the Cortex Dashboard) as well as dataset =

How can I see if my FW has already been exploited by the CVE-2024-3400?

Hello team

How can we determine if your device logs match the known indicators of compromise (IoC) for this vulnerability?

I have already fixed the vulnerability and I have the TSF of my device and I want to see if I have been exploited before applyi

CVE-2024-3400 IOC's

Hello All,

Its a twitter link but will try and summarize the process. 

https://twitter.com/cyb3rops/status/1781294529586331650

Issue in enabling the "content-repository" feature.

Hi Team, I have a customer who wants to enable the "content-repository" built-in feature.

They tried the below steps:
1. First, they have enabled the feature successfully in DEV.
2. Next, when they enabled the feature in PROD, they got an error (refer

Phisphing feeds and enrichment

Hello, I need your help. I need feeds for domain classification and another feed for phishing, to determine whether domains, emails have been compromised or not. What do you recommend for Cortex XSOAR  

What feed and integration people use??

I need

XSOAR Upgradtion Issue

Cortex XSOAR 8 will have a new FQDN and IP Address in the new platform. May I know is there any existing playbook have pulled the XSOAR data, and export to third-party platform automatically? If yes, it may require to re-configure the IP Address.

C

XSOAR Incident Re Run

soemtimes for testing purpose we need to create similar incident again but I am stuck at this phase. I have exisiting incident and i want to re run it(either manually create, duplicate and re run it or just simply re run exisitng incident, or importi

XSOAR - GET-GPO DisplayName

Hi,

I've created a playbook to analyze some alerts related to SOC and GPO, but the alerts come with ObjectGUID and I need to convert the GUID to DisplayName.

In PowerShell, the command is simple: (Get-GPO -Guid "$GUID").DisplayName.

I tried running

BIOC API access

Hello Folks,

In the Cortex API documentation there is not mention of how to make BIOC rules using APIs or how to access them.

I was wondering if anyone has been able to use the API to create BIOC rules.

Global protect saml using custome port number

 we have configure the global products saml  authentication with 443 in azure AD but we need to configure with the custom port number 1194 is it possible

Should we block HTTP range requests?

I have found a few short discussions about how to block range requests, and an article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJsCAK.

My question is whether we should be blocking them because they present a thre

Attaching Additional Managed disk to PA VM300 in Azure

we have a PA VM300 Firewall deployed in azure. we need to increase log buffer for the firewall and our plan is to add an additional 2TB managed disk. please support if there is any configuration to be done after adding the disk through Azure portal t

Getting an error while pushing the policy from Panorama to local PA- 3020 firewall

Hi Guys,

I'm  getting  below error while pushing the policy to local connected PA-3020 firewall. 

• Performing panorama connectivity check (attempt 1 of 1)
• . Panorama connectivity check failed for 10.120.19.106. Reason: Certificate error, reverting co

Panorama fails to upgrade itself with error: Label sysroot1 does not indicate a valid image

Hi all,

      last time I tryed to upgrade my Panorama, I had this error: "Label sysroot1 does not indicate a valid image".

The panorama is working, also I'm able to upload images and content to managed firewall, only I cant upgrade itself.

Is not re