Security Operations

Browse the Community

Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

2504 Posts

Cortex XSOAR Discussions

Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

1285 Posts

Cortex Xpanse Discussions

Cortex Xpanse builds a system of record that is the authoritative source for an organization’s global Internet assets; it knows your attack surface so you can own it before someone else.

10 Posts

Cortex XSIAM Discussions

Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.

127 Posts

Get specific word from files

Hi, Please, any idea to get specific word from files via BIOC or XQL? For example: password, username.... BR.

Get all chain of process related to causalty actor

Hi, Please, can we get all chain of process related to casualty actor via XQL. For Example👇 BR.

Resolved! StoreDesktopExtension.exe - As Malicious

Hi, recently i receive a lot alerts, related with StoreDesktopExtension.exe , this is usually a legitimate Microsoft Store component.Anyone with same issue?

XQL Query

Can we fetch grouped issues by the help of XQL query. Like if same issues is running again and again in short period of time than that comes with +1 or +2 on console. So can we able to find that +1 or +2 issues which is grouped in a single issues through the help of XQL Query. Cortex XDR

Resolved! Assets -> Network configuration

Hi everyone, Does anyone know if the ‘range names' created in the network configuration of the assets option can be seen in the assets information, or somewhere else, of the issues or cases? Thanks in advance. Regards, J.Risquez

Android Cortex XDR

I want to know how to perform an XQL query for Android devices, where I search by hash and it shows me all the devices that have that .apk with that hash, or I can search by name.

Android Cortex XDR

Does anyone know how to perform bulk queries in Cortex XDR for Android devices? I want it to show me all Android devices that contain a specific hash or that contain the same APK file. Please, I'm open to suggestions.

Resolved! Query for Datasource and related cases

Hi. I try to create report for different datasource which create Cases or issues. i got error > Aggregation by original_tags field of type array is unsupported. when i try to use COMP with original_tags Here is example what i try to do > | filter (`resolution_status` in (RESOLVED_FALSE_POSITIVE, RESOLVED_TRUE_POSITIVE)) //| filter (`res...

Can we upgrade Cortex XDR agent version to CE version from console ?

Hello , Can we upgrade Cortex XDR agent version to CE version from console without any restart or downtime? Cortex XDR

Does lookup or snapshot type dataset contributes to Hot storage

Hello Everyone, We have lot of lookup file and some snapshot type dataset in our environment. Does it contributes to hot storage. If so how can i verify its size. Also i wanted to how the snapshot type dataset are created in XSIAM. Thanks in advance. Regards,Vinay A S