About eumbach

"Though, encrypted traffic is sometimes used" Like Clients talking to a Domain Controller?  Are there any recommended exclusions? Known False Positives?  Right now, we are looking to have to disable this on the Client VPN and all East/West Traffic to DC's which seems pretty large.  ... View more

Was a proper secure solution ever found? Creating an exclusion when the destination is your domain controllers isn't really safe.  ... View more

Hey Sorry I had missed this.      ... View more

For Anyone following we have created our own Splunk App which uses the API to pull in alerts and map them by alert source to datamodels. The Python was not nearly as complex as we thought it would be.  Get Alerts (paloaltonetworks.com)   ... View more

"...We were told that Splunk integrates with XDR..." - We were told the same thing, and it does... in the since that XDR can ingest Splunk logs, but not the other way around. As a customer we have spoken with Product Management, Sales, VP of XDR, the Development team for the Splunk App with no resolution hence us finally giving up and coming to the LIVEcommunity to see if anyone else out there has a solution.  ... View more

Syslog is not supported in the PAN_TA for Cortex XDR so there is no parsing of the fields.  Cortex XDR · GitBook (paloaltonetworks.com) Cortex XDR incidents are cloud-hosted so logs are retrieved by Splunk using the Cortex XDR API (syslog not supported).   The method that is supported is with API but it only pulls the INC# and a link to the XDR console which doesn't provide value for correlation. This use to work using the TRAPS syslog parsing but that was removed in 7.X and forward.  ... View more

"..That is the reason why even we at xdr use hashes we do not totally rely on them, we do behavioral analytics and ML to spot the malicious...."   And yet the number one solution on the Live community forms for tuning is to whitelist/blocks list by hash.... you can't have it both ways. It's either a solution or it isn't.  ... View more

Yep we currently have over 2100 "Allowed" hashes (growing 300+ a month) and had to drag our dev team kicking and screaming to sign every tiny little application across the entire environment. And still get about 700 LC alerts a week.  ... View more

1. With any other antivirus you wont get any alert if a user dissapears otherwise you would have thousands of false possitives when a user shutdown computer or goes on holidays ...    Maybe I'm misunderstanding but that's really not the case we get alerts when any part of windows is disabled shutdown or not, we just filter out those services when next to a shutdown event. Nor is any of this finger pointing productive.    @KanwarSingh01 : You can setup a simple IOC to alert you when the XDR Clearer is utilized. The SHA and/or the filename can be used as each version is different depending on the agent. As soon as the cleaner is Dropped on the device's HD and executed this can be alerted on in the functional situation you are referencing. If the Agent is truly offline then you will not be able to monitor it's use without external tools like Sysmon / Windows Event logging.  ... View more

About the on-write scan you will have to wait until you update the agent to 7.6  We are on 3.1 and 7.6. Did this feature get pushed on this release?  ... View more

Have you looked at network discovery from 7.5?    About Asset Management (paloaltonetworks.com) ... View more

PAN Cortex XDR isn't a SIEM!   Also PAN check out Cortex XDR 3.0 now with correlation searches and the ability to ingest data from anywhere!!!  😄 ... View more

Same, just added a new BIOC to take care of it.  ... View more

Hey Eluis,   I'd have to disagree with the scan once and you're good comment. We've had Cortex XDR for a year and scan weekly, and it is always a challenge. Found 11,059 out of 76,738 results. This was our last 30 day results. I also haven't noticed XDR scanning at time of write to disk. I can download anything I want and XDR won't pop off until it is executed. When I dedupe this list with the month before it's reduced from 11k to 56 😞 More than happy to discuss with you on how you managed to achieve your results. Most of these are marked Benign so I'm not sure why it wants to alert on them again.      ... View more