About jcandelaria

Is it possible to increase the severity of these rules to Medium and higher? Yes, you can manually change the incident severity by clicking on the three dots on the top right corner and select change severity. Note: You cant change the actual rule severity that initially triggered the alert.   Is it possible to set the policy to block when identifying these specific rules on the XDR Tenant? No since these are analytics rules, but what you can do is investigate this analytics/bioc analytics alerts and create your custom BIOC rule based on your investigation/criteria then you can assign that custom bioc rule as prevention rule which you need to apply to restriction profile.   From what I understand of these rules is that due to the fact that they are built-in rules that are provided by PAN they cannot be altered or their conditions cannot be viewed. Correct   What can I do in order to allow the agent to actively target these threats? What you can do is investigate this analytics/bioc analytics alerts and create your custom BIOC rule based on your investigation/criteria then you can assign that custom bioc rule as prevention rule which you need to apply to restriction profile.   Reference: Configure Custom Prevention Rule: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BIOC-Rule https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/custom-prevention-rules/ta-p/347271   ... View more

@FlorentinGrama  You can check one of our how to videos: https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/xdr-how-to-video-role-based-access-control-rbac/ta-p/465068   You can explore our journey phases in our Live Community page and select whether you have Prevent or Pro license. ... View more

@Jeroen_Proost    Check out our webinars (link below and with the help of SmartScore feature (link below), this will help/guide Analyst which incident to prioritize and investigate.  You can explore our journey phases in our Live Community page and select whether you have Prevent or Pro license. https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/customer-success-webinar-cortex-xdr-soc-analysts-understanding/ta-p/488372 https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-alert-tuning-operations/ta-p/505838 https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/cortex-xdr-how-to-video-smartscore/ta-p/513374         ... View more

@Shashanksinha  Can you be specific on the question? Typically anything medium, high and some low severity are part of an incident already. When you open an incident, you can right click an alert (except insight) --> manage alert --> select move alert from incident --> then you have the option to "Move to Existing Incident" or "Create New Incident"   Reference on Incident: https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/customer-success-webinar-cortex-xdr-soc-analysts-understanding/ta-p/488372 ... View more

Hi @Shashanksinha    Below is the link for wildfire test pe file to test the pe module. https://docs.paloaltonetworks.com/advanced-wildfire/administration/configure-advanced-wildfire-analysis/verify-wildfire-submissions/test-a-sample-malware-file   Typically an organization will have an audit or pen-testing group/company that evaluate the different protection capabilities using their own tool or resources  ... View more

just to validate.. when you look at the endpoint administration, there are option for cloud id and cloud info. And on Assets --> Cloud Inventory, there are additional options to show, what your looking for is not showing?   ... View more

@N2Z2 Kindly check our live community journey Integrate phase --> select Pro --> select one of the How to Videos for which functionalities you want to activate.. ... View more

Hi @MithunKT  I'm assuming the QRadar data gateway is not an option? Typically this is what I encounter on customer that have QRadar. ... View more

@Daniel_Itenberg    Kindly refer to our webinar --> around 12:15 timeframe https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-alert-tuning-operations/ta-p/505838     ... View more

@RFeyertag    Adding perspective on this question as one of my customer had this process: 1st --> isolated the potential compromise endpoint (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/response-actions/isolate-an-endpoint) 2nd --> assign agent profile with forensic enable (step 10-->item 4 --> https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/customizable-agent-settings/add-agent-settings-profile) 3rd --> wait 24hrs to collect all forensic data (can be customize to lower hrs) 4th --> once data is available, start triage.. (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/forensics/forensics-add-on-options)   Below are additional info on forensics: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/forensics     ... View more

additional info on broker VM losing connectivity.   ... View more

In addition to the information and replies, I would like to add the reference below. You can add third party ingestion sources which can provide added analytics detection. Also by adding more external data ingestion, you can build and create your own correlation rule alerts. Basically you can build your own analytics or alerts based out of these ingested data using XQL.  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/analytics-alerts-by-required-data-source ... View more

@denis.wong  Definitely support is the way to go so it can be track for investigation and enhancement if possible.  Unfortunately, you need to have a standard support account, please reach out to your account super user/admin so you can be added to the account. ... View more

Hi @KanwarSingh01    Alot of the PUA are considered grayware, there is an option on malware profile  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-profiles/add-malware-security-profile   Grayware —The sample does not pose a direct security threat, but might display otherwise obtrusive behavior. Grayware typically includes adware, spyware, and Browser Helper Objects (BHOs). As @eluis mentioned, you can manually add the hashes to the block list. Also you can do restriction profile as an option https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-profiles/add-restrictions-profile ... View more