About neelrohit

An attempt to end  discussion with an evidence of test result is posted below.   If this is not the expected behaviour in your environment, please open a support ticket and our support team will be able to distinguish between break fix and configuration changes:   ... View more

Hi @kindzma ,   Not that I meant that our customers aren't wise enough. But finger pointing and blaming at what vendors can do and what not is not the context for this forum. We are not attempting to defame an person, organization or a product in this forum, rather answering questions only. Please note that being a customer for Palo Alto also means that our customer have collective belief in our products and have opted it with the test and trust.    I am glad that you understand that we at Palo Alto Networks stay firm to defend on use cases which are possibly false implications on our product and also stand welcoming the questions for answers to help our customers with their keen to understand the functions.   As a result, if there are questions which is probably not openly documented,  we have teams who can ensure our customers (including first responders ) do get the information delivered in a secured and detailed fashion as and when they enquire about it. I believe we are misunderstanding this forum as a source of training and possibly you could look for webinars and resources which could help answer your questions better and build your trust further than just fingerpoint. And, for pre-sales, yes, it may vary, but many a times first responders do also participate in PoC for the product.    Because you have lot of issues to point at, I would recommend reaching out to your customer success teams if you have one and you can also reach your SEs to guide and enable you on the detailed functionality of the product and you can also raise feature requests if you think could be a use case with them.   Hope that clarifies all the misalignments in conversation and also the expectations on questioning and commenting on this forum. ... View more

Hi @kindzma ,   Not to fingerpoint, but there are lot of things which organizations can do products evolve. Not to blame anyone for it, but first responders who would be wise enough can also have a nack ask these questions and get first hand answers during pre-sales and also with professional and education services that we have.  The blackhats would have the info doesn't mean we expose it to even the ones who would not want to be red teaming on things. We suggested masking or removing inorder to ensure you as org do not share information which goes beyond the privacy circle as such.    With that being said, we appreciate delivering responses in a non-blame game fashion provided where we do not need to defend for something which looks like a targetting rather than nice questions.  ... View more

Hi @kindzma ,   Since our tech docs are public by nature, we see a serious concern in exposing this information in public docs. With that being said, since this also is a public forum, it would be great if you could alter/mask/remove the data of the filenames provided in the list in your query above. On the query of these files being definitely benign, you can try running malware scan on the endpoint and you should be able to see that none of them would be flagged as malicious. If there is one, that technically would not be file placed by XDR agent. Yes, it really depends upon how you have configured your malware profile for anti-ransomware module. We have "Normal" mode and then we have "Aggressive" mode. Normal mode creates honeypot files at many places as per the randomisation logic and does have a limited scope(custom folders not linked to system processes in root, etc.). While the "Aggressive" mode as suggests creates files pretty much everywhere. It would depend on Normal/Aggressive configuration and also the number of folder paths and file paths created over a course of the month at targetted system locations. If the folder creation activity at critical spaces is intensive, so would be for this module. We have had a use case to test and configure Aggressive mode on a file server for a month and we found that the honeypot files were created and almost took 4-5Gb of disk space on the server. It soon became better when we reverted to normal mode and rebooted the server. It would be everywhere. They are just set to hidden. Again, you might want to check the policy configuration on this VM.   Hope this helps!   Please mark the response as "Accept as Solution" if it answers your query. ... View more

Hi @kindzma ,   these are honeypot/decoy files deployed by cortex xdr agent to prevent against ransomware events. The methodology of ransomware detection of Cortex XDR is by the method of deploying honeypot files in different locations depending upon the mode and any attack which is vectored at file modification will be prevented when the attacker process touches any of these files.     ... View more

Hi @Shahwaz_Md ,   Thank you for writing to live community!   Not sure why would you want RHEL 10 in the list  as RHEL 10 itself is not released yet and will be officially released in 2025. We support compatibility and support only for OS versions after their official GA date.   Hope this helps!   Please mark the response as "Accept as Solution" if this helps. ... View more

Hi @AVogel ,   Thank you for writing to live community!   For the broker VM to act as a download source for content and agent upgrade caching, there are some requirements that needs to meet.  Supported with XDR agent version 7.4 and later releases and Broker VM 12.0 and later. Requires a Broker VM with an 8-core processor to support caching for 10K endpoints. Requires the Broker Vto have an FQDN record in your local DNS server. Requires you upload a strong cipher SHA256-based SSL certificateswhen you setup the Broker VM. Requires adding the Broker VM as a download source in your Agent Settings Profile. Of all the above, the primary feature to list the broker VM for selection for download source is to add an FQDN to the broker VM. Once added, it is listed down in the agent settings profile to be added as intermediary download source. Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Activate-the-Local-Agent-Settings     Hope this helps!   Please mark the response as “Accept as Solution” if it answers your query.     ... View more

Hi @Tobias_Bartsch ,   I understand your query now. As per my understanding you intend to check if installing XDR agent on endpoints running SAP HANA applications is officially certified. We will check this internally and let you know if the installation and running is supported on this environment. ... View more

Hi @Tobias_Bartsch ,   Thank you for writing to live community!   We support only standard distros of linux with standard kernel version support on them.   I am appending the link for Linux compatibility matrix for installation for your reference.   Hope this helps!   Please mark the response as "Accept as Solution" if it answers your query ... View more

Hi @Vijisaga ,   Thank you for writing to live community!   Assuming you have referred to the guide for Agent installation on Windows 8.1 which needs FIPS mode enabled as mentioned in the guide here.    Can you let us know if you are getting an error during installation and you are using agent version 5.0.11 and earlier for installation? Assuming all of the above is true, we would recommend, performing the install with the verbose logging enabled to see the error and open a support case if needed.  To install the agent using verbose logging, follow the commands below: msiexec /i /L*v <filepath of installer>\<installername>.msi /qn   Once found, either you can try fixing the same or open a support case for detailed investigation. Hope this helps!   Please mark the response as "Accept as solution" if it helps ... View more

Hi @Shashanksinha ,   Thank you for writing to live community!   Following is the response to your query below: Please refer to End Of Life summary for all PANW products here: Cortex XDR Agent End of Life Summary  The Traps agent or agent 5.0 is a native agent with no enhnaced detection capabilities as of date and supported on very old operating system versions which have been announced EoL by OS OEMs more than 2 years ago. With the passing of time, it is also recommended that these OS should be decommissioned which means organisations should strive to update to the latest OS versions for latest features, functionality and support in terms of business operations and cybersecurity standards. If you look at the agent installation matrix, you would find clearly that the agent is supporting installation on Operating Systems which can now be declared as borderline antique let alone being outdated. Post EoL, Palo Alto Networks will not support installation of any agent version on these OSs and the ultimate change would be to replace the OS with latest or the farthest supported OS. Even today with the agent 5.0, which does not provide any EDR data collection, endpoints with these agents do not provide enough security context to support an advanced next gen security solution which means the most advanced TTPs are not detected as such which essentially would be available with the latest agents. On top of that new protection modules which have dependency on minimum agent version(take eg of Java Deserialisation Protection on Windows to protect against Log4j attacks which needs minimum of agent 7.6 to work for detection and 7.7 for prevention) would not be applicable for these outdated agents. Also, once the agent goes EoL, all the content updates which enhance security, stability and compatibility of the agent on the endpoint will be stopped. This essentially means that any new security updates and protection against any zero day attacks(which could be covered as part of the base minimal functionality of the agent will not be covered) and any performance issues and stability issues will not be handled by Palo Alto Networks support anymore.  Customers can adopt their own strategies and methodologies to perform the protection. As mentioned in 3rd, having an EoL agent on an antique software though is not a recommended, but you have protection in its base minimal functionality until the last date of EoL. Post that customers can choose their own strategy to think about the future of the endpoint and possibly upgrade the OS and stay on top of the best possible available security updates with Cortex XDR agents available at that time. Hope this helps!   Please mark the response as "Accept as Solution" if it answers your query. ... View more