Security Operations

Browse the Community

Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

2054 Posts

Cortex XSOAR Discussions

Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

1112 Posts

Cortex Xpanse Discussions

Cortex Xpanse builds a system of record that is the authoritative source for an organization’s global Internet assets; it knows your attack surface so you can own it before someone else.

7 Posts

Cortex XSIAM Discussions

Cortex XSIAM, the autonomous security platform powering the Modern SOC, operates across cloud and enterprise security operations, providing true end-to-end management of threats wherever they originate.

36 Posts

Cortex XDR - Solutions for log collection without an official integration

Has anyone found a good approach for collecting logs from an API when there isn't an official Cortex XDR integration? For example, Automox has released a Splunk and DataDog app, but the custom collection in Cortex XDR isn't a good fit. We use the B

...

how remove softwares with XDR

Hello,
I've two questions.

First, I would like to know about your experience. How do you handle uninstalling software on specific devices that are not allowed and need to be removed via Cortex XDR without the user noticing?

The second question is: Is i

...

Remove apps with Playbook XSOAR XDR

I would like to know about your experience. How do you handle uninstalling software on specific devices that are not allowed and need to be removed via Cortex XDR with Cortex XSOAR Playbooks without the user see the uninstall.

Web File Repository Integration error "Failed to execute wfr-status command"

Hi,

Anyone encountered the following error when executing "wfr-status"?

Command:

!wfr-status(Web File Repository)

Reason

Failed to execute wfr-status command. Error: Verify that the server URL parameter is correct and that you have ac

...

AWS CloudFormation preset template for Cortex XDR

Hi Cortex XDR community,

We are trying to set up Cortex XDR to ingest cloud assets from AWS. It mentioned that aws clouldformation stack needs to be created using preset Cortext XDR template. Where this template can be found? Is there a link to dow

...

Compare results in table to lookup?

I have a lookup with software names and want to use it to compare it to results from xdr_data using the fields actor_process_image_path which is the dir the software in installed in.

config case_sensitive = false
| dataset = xdr_data
| filter event

...

Resolved! Cortex XDR agent deletion after a period of time

Is there any way to delete Cortex XDR agents automatically after a period of connection lost, like 6 months or so? We have a server which was not used for nearly half a year, and our IT team says its agent was deleted without them knowing. Is it real

...

Resolved! Broker VM shown disconnected

Hi, our Broker VM is shown disconnected on XDR console. The VM is up and running and I can connect to it via SSH. It can connect to the paloaltonetworks.com domain as I can see the traffic on firewall. Version is 25.0.44. Even the last seen is today,

...

Device Permanent Exceptions - Is There A Limit?

Hello-
Is there a limit to the number of devices that can be listed within the Permanent Exceptions? Endpoints -> Policy Management -> Extensions -> Device Permanent Exceptions

Thanks.

HELP With XQL Query to fetch All Assets

Hello Everyone,
I want to fetch all assets from asset inventory using XQL query but I am unable to find a suitable dataset for it. Can someone please help with XQL Query to fetch all the assets.

Thank you

Cortex XDR

How to check your ELA(Enhanced Application Logs)

We enable ELA on our NGFWs, forward logs to SLS, and also ingest the SLS logs into our XDR tenant.
Is there a way to verify in the XDR tenant or SLS that logs have been enriched by ELA?

Resolved! About XSOAR Free Edition Licenses

Dear All,

I installed the free version of XSOAR.
However, when I installed XSOAR after the 30-day free license period, the license was not applied properly when I applied the license file.

Can I get the free license again by applying again from th

...

no alerts no incident

Hi everyone, i have an issue. Cortex receives data from data sources (endpoints, servers etc) but i can not see alerts and incidents. My dashbord shows 0 alert and 0 incident. Who could help to me?

Cortex XDR Integration with NGFW

Hello,

I have Cortex Pro per GB license and NGFW. I have successfully created certificate and it is showing as valid in XDR console. I have created a profile which is sending logs to Data Lake. I have applied it on many policies. But I cannot get

...