About etugriceri

Hi @Aiman_Fathima    You can use below query. You should have enough telemetry data for this task, if you enabled XDR Pro on the endpoint.    dataset = xdr_data | filter os_actor_process_image_path = "/usr/bin/sudo" and os_actor_process_command_line contains "cd"     ... View more

Hi @Bernat  You cannot un-install Cortex XDR, if your old company enabled Anti-tamper protection and if you dont know uninstall password. You can try with Password1 . This is default password but we are highly recommending to change this password and most probably, Your old company is not using this password anymore. You can reach out them to learn password.   i saw your agent 7.3. this is unsupported version and not supporting token based one time uninstall password which means that you need general or policy based uninstall password.    You can open TAC ticket to get xdrcleaner.exe but since you dont have active support contract, maybe your old company open a ticket for you.   https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide/Uninstall-the-Cortex-XDR-Agent-for-Windows?section=UUID-1a571be7-5e84-ad88-372c-76f7fc579e07_id183HK0SK0O4 ... View more

Hi   @Shashanksinha I believe you can check below two command outputs for this task.    C:\Program Files\Palo Alto Networks\Traps>cytool.exe  last_checkin Persistent Last Successful Check-In time Last Successful Check-In time (UTC): 2022-11-18T11:19:55Z Last Successful Check-In time (local): 2022-11-18T11:19:55Z   C:\Program Files\Palo Alto Networks\Traps>cytool.exe info query Content Type: 760 Content Build: 24182 Content Version: 760-24182 Event Log: 1   ... View more

@trevor_debeer , in addition to NeelRohit answer, XDR is supporting endpoint isolation on Linux hosts which using iptables. XDR is capable to manage iptables but currently not supporting managing rule sets via XDR management console.  ... View more

Hi Muthuvel,    I think the question is how can we see delete/flush command ? But event its, still some of the important informations are missing like What is the alert source?  did you try to investigate casualty chain?  did you check action_remote_process_image_command_line or actor_process_command_line fields for parameters?  is your time line correct when you use Query builder? ... View more

Hi Tamara   https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server   Check Step 11. You can download client and CA cert and use them in NXLog app.  ... View more

Hi Alexander,    Since 3.5 released, We have new menu item in Settings which "Exception Configuration".  For adding file or folder in to Allow list please follow  Settings>"Exception Configuration">Legacy Agent Exception. This same configuration which you add in profiles previously.      ... View more

Hi @Cyber1985    I believe you can use below XQL query.    preset = xdr_file | filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN and action_file_path contains "\NamedPipe\" ... View more

Hi Nathan,    FILE_CREATE_NEW is just related with file creation on disk without writing data. Could you check size of event_sub_type = FILE_WRITE ?   ... View more

Hi    for me its not clear why they disabled telemetry data collection or no telemetry data collection. If they enabled XDR Pro, There is telemetry data collection unless they disabled from agent settings > XDR Pro endpoints > Monitor and Collect Enhanced Endpoint data.  ... View more

Im gonna recommend open a TAC case for this. Default quota is 5 Gigabyte (Max 10) and should not spend more than this. Should be investigated by TAC engineer.  ... View more

Dear @eumbach    As you mentioned forward from CDL is not including XDR data. If you have PANW Firewall has been integrated with CDL, You can use CDL forward option.  I believe best option is to use Alert forwarding from Cortex XDR. (Configuration>Notification>Add Forwarding Notification). I dont know why syslog data dropped on splunk but i guess this is something you need to fix on splunk side.  ... View more