Security Operations

Browse the Community

Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

2481 Posts

Cortex XSOAR Discussions

Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

1283 Posts

Cortex Xpanse Discussions

Cortex Xpanse builds a system of record that is the authoritative source for an organization’s global Internet assets; it knows your attack surface so you can own it before someone else.

10 Posts

Cortex XSIAM Discussions

Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.

121 Posts

Install XDR agent for unmanaged PC in remote users

hello experts, we got users who is work from home. no IT support, looking for a way to install XDR agent for users. using teamview or anydesk?? any experience to share? Thanks SdG

Vulnerability Assessment in XSIAM 3.3

Does anyone know what happened to the Vulnerability Assessment in XSIAM after upgrading to 3.3? I used to be able to do Inventory → Endpoints+Host Inventory → Vulnerability Assessment, select Endpoints on the upper-right bar and then search by Endpoint Name and view vulnerabilities. This is no longer present in XSIAM 3.3 after the updated Vuln...

Cortex XDR: create endpoint groups

Good morning, maybe someone could help me to find out if there is any option to create several endpoint groups by uploading a file or by other means. From the inventory -> endpoints -> groups, it seems that it is only possible to create one endpoint group at a time. Thanks in advance. Kind regards,

map incident data

Hello, How can Cortex XSOAR be leveraged to map incident data, playbook actions, and adversary techniques to the MITRE ATT&CK Framework?

Rule for Detection Powershell Execution

I created a BIOC to detect running processes in PowerShell and I intend to exclude some processes to avoid showing too many false positives, such as: SenseIR.exe and CompatTelRunner.exe. Cortex XDR

How to escape a wildcard (*)

How could you escape a wildcard in a query For example if i am looking for suspicious LDAP queries like (objectclass=*), i need that to be literal and not match on things like objectclass=example. I have tried many different combinations including just a simple \* but have not found anything that works

Resolved! Result empty after using json2html script

I found the issue after using script json2html table to convert json array to HTML table. it's return to empty vaule. Do you have any idea?

Defining a Known User Object List for Automated Playbook Logic in XSOAR

I need to define a known user list as an Object List so that the playbook can automatically check it. If the username involved in the incident is found in this known list, the condition should pass and the incident should move forward toward automatic resolution. How do we properly define a list inside the playbook and configure the logic so t...

Playbook to enrich dataset data into alert context

Hi, Is anyone able to guide me on how to achieve this perhaps? I want to ran a task in a playbook that will do a custom query in a dataset and pull information and add it to the alert context data.. is this possible and if so guidelines would be appreciated. thanks in adv

Enriching context data with info from datasets

Broker Helath Checking

Hello everyone! I working in a environment that have some broker clusters and local brokers as well, I would like know how I can implement some way to have a daily health checking for these brokers, like if the broker is need a reboot to update, if I don't have any Gaps in receiving logs (for example the last logs received was one day ago) etc...

Advanced Authentication Cortex API

Does anybody have any examples of how they have implemented Advanced Auth for the Cortex APII only have PowerShell available examples using that that would be preferred, but I can probably interpret most scripting languages.If not examples, maybe links to articles discussing the process to implement it more generally.Cortex XDR

Resolved! Force XDR Agent

Hello, Please, how to force XDR Agent to capture all commands on CMD and PowerShell without GPO? For example, we can detect quser command, but we can't detect Set-Alias command. The problem is another vendor can detect any command line running in memory. Best regards.

[Cortex XSIAM ] XDR Collector Collect Windows Security Log。XDR Collectors Administration Status display "Error".

Currently, I'm using the default templates. Despite trying many tests, this error message persists. Am I missing any information? XDR Collectors Administration Status display "Error". Error Message : Exiting: no modules or inputs enabled and configuration reloading disabled.What files do you want me to watch? XDR Collectors Administration ...

Want to use Cortex XDR Agent Cleaner but cant log support as licenses expired

Hi all, My XDR portal has expired and i want to use/test the Cortex XDR Agent Cleaner as part of my role. Can i access this tool elsewhere, or can i use my support for my other Palo products to request this?

User

Count

User

Likes Count

Browse the Community

Cortex XDR Discussions

Cortex XSOAR Discussions

Cortex Xpanse Discussions

Cortex XSIAM Discussions

Activity in Security Operations

Install XDR agent for unmanaged PC in remote users

Vulnerability Assessment in XSIAM 3.3

Cortex XDR: create endpoint groups

map incident data

Rule for Detection Powershell Execution

How to escape a wildcard (*)

Resolved! Result empty after using json2html script

Defining a Known User Object List for Automated Playbook Logic in XSOAR

Playbook to enrich dataset data into alert context

Enriching context data with info from datasets

Broker Helath Checking

Advanced Authentication Cortex API

Resolved! Force XDR Agent

[Cortex XSIAM ] XDR Collector Collect Windows Security Log。XDR Collectors Administration Status display "Error".

Want to use Cortex XDR Agent Cleaner but cant log support as licenses expired

Result empty after using json2html script

Force XDR Agent

I want to block commands and special operations that require administrator privileges on Windows.

Can Cortex XDR fully substitute for Microsoft Defender Attack Surface Reduction (ASR) rules?

Evasion Technique - 1244315488

Re: Force XDR Agent

Re: Problem with Conditional Task Not Matching XQL Output in Cortex XSIAM Playbook

Re: Creating a custom command for XSOAR marketplace integration

Force XDR Agent

Re: I want to block commands and special operations that require administrator privileges on Windows.

Unlock your full community experience!

Browse the Community

Resolved! Result empty after using json2html script

Resolved! Force XDR Agent