This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Security Operations
Post questions, provide answers, share best practices, and connect with peers and experts in this area dedicated to Cortex XDR, XSOAR, and Xpanse discussions.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Security Operations
Post questions, provide answers, share best practices, and connect with peers and experts in this area dedicated to Cortex XDR, XSOAR, and Xpanse discussions.

Browse the Community

Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

2665 Posts

Cortex XSOAR Discussions

Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

1310 Posts

Cortex Xpanse Discussions

Cortex Xpanse builds a system of record that is the authoritative source for an organization’s global Internet assets; it knows your attack surface so you can own it before someone else.

10 Posts

Cortex XSIAM Discussions

Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.

186 Posts

Cortex Cloud Discussions

Share ideas and post questions related to Cortex Cloud — the industry's most comprehensive cloud native security platform — and the compute capabilities available within it in this forum.

479 Posts

Activity in Security Operations

Claude AI Activity and False Positive Alerts

Hello, Recently, I’ve been noticing quite a few false positive alerts related to the use of Claude AI. I’m investigating these alerts and trying to understand exactly what Claude is doing on the endpoint. I would like to review the command history and the actions performed by the application, but I cannot find enough information directly in the ...

Need help in validating XQL query to identify suspicious MFA registration from new GEO location + new device

dataset = okta_sso_raw| filter (debugContext contains "New Geo-Location=POSITIVE" and debugContext contains "New Device=POSITIVE") and (eventType in("user.mfa.factor.activate", "user.lifecycle.create", "system.import.user.create"))| alter user_id = if(eventType = "user.lifecycle.create" or eventType = "system.import.user.create", json_extract_sc...

Resolved! Cortex XDR Post-Quantum

Hi team, I would like to inquire about formal information and guidance regarding the post-quantum cryptography (PQC) strategy within the Cortex XDR ecosystem. What developments, features, or updates planned on the Cortex roadmap could you share with us? Is there currently any functionality, pilot, or integration in the console or agents that add...

A month-Old Issues Triggering a Case Now

Hello Community, We have identified several cases where the associated issues are showing dates from August. Has anyone encountered similar behavior? Could you please share your insights on the possible cause of this scenario.

S.Edwin by • L0 Member
  • 154 Views
  • 1 replies
  • 0 Likes

Cortex XDR Linux Agent: IPC error 107 caused by SELinux denying execution of pmd

Cortex XDR Linux Agent – IPC error 107 / traps_pmd.service failed to start Environment Palo Alto Networks Cortex XDR Agent for Linux Oracle Linux SELinux: Enforcing /opt: XFS /opt was mounted without noexec Symptoms After installing the Cortex XDR Agent, cytool status failed with: Failed to get status summary data from the agent, err...

Resolved! Performance Impact of Cortex XDR Process Monitoring and Process Injection Detection

Hi, We would like to understand whether there is any way to determine which processes are being actively monitored/analyzed by Cortex XDR on an endpoint and, more importantly, what performance impact this monitoring may be having on the applications. We are particularly interested in understanding whether process monitoring, process injection de...

tlmarques by • L4 Transporter
  • 394 Views
  • 1 replies
  • 0 Likes

Issue with XSOAR File Management Integration

We are currently integrating the XSOAR File Management integration with Cortex XSOAR 6.14. During the configuration process, we are encountering an "Invalid Server URL" error, even though the configured server URL has been verified and appears to be correct. Could anyone please share the configuration steps, prerequisites, or any documentation f...

XSIAM VPN Analytics

How do i get third party vpn logs to work with the xsiam analytics rules (https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-vpns). These are vpn products for which xsiam doesn't have an in platform data model rule so I would have to create one. I need to know how to create one so that the analytics rules...

Cortex XSIAM/XDR - Java File Examination conflict in Policy

Hello Team,"We have observed that every agent upgraded to version 9.2.1.285 on Citrix devices (VDA, MCS) changes its status to "Partially Protected" after the cyserver restart.As the number of devices falling into this status has been increasing, we have temporarily modified the policy to prevent further upgrades on these systems until the issue...

Resolved! analyse d'un pc

Bonjour je voudrais savoir si avec la console cortex paloalto je peux faire une analyse d'un pc? En vous remerciant par avance. et si cela n'est pas possible comment je peux le faire si vous avez une procedure je suis preneuse . Merci a vous belle journée

Resolved! Monitoring new network interface connections (USB NICs) via BIOC / XQL — Looking for best practices

Hi everyone,I am looking for guidance or community insights on how to monitor and track the connection and usage of networkndevices (especially USB Ethernet adapters, Wi-Fi dongles, and USB tethering) on Windows endpoints. Our goal is to detect whenever a new network interface is attached/enabled, capture its timestamp, and ideally trigger an al...

Load more
Top Solution Authors
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks