About bbarmanroy

Hi @odonaldadmin you can take a look at this link which describes how to configure Cortex XDR to forward to a syslog receiver. You can then use the same to forward logs to the syslog receiver as stated in this link. ... View more

Hi @michaelsysec242 the ability to create custom BIOC to terminate an execution should do the trick. Please look into this LiveCommunity post where the solution has been explained. ... View more

Hi @FabioFerreira you can assign tags to endpoints where XDR agent is installed. For such endpoints where XDR agent is not installed but are domain joined, you can leverage the Cloud Identity Engine dataset (pan_dss_raw) to cross-reference the data with endpoints data to identify assets which are a part of the organization domain but are not in the endpoints dataset. This can be achieved with a XQL query. You can run this as a report on a periodic basis to get the list of endpoints without XDR and then leverage organizational processes to get XDR installed on those endpoints.   For endpoints that are disconnected, outdated or disabled, you can leverage separate Correlation rules to look in the endpoints dataset.    1. For disabled status -> refer to this LiveCommunity post 2. For disconnected -> refer to this LiveCommunity post (you need to add a filter for endpoints with the specific tag) 3. For outdated -> refer to the this LiveCommunity post (you need to add a filter for endpoints with the specific tag)   Hope this helps.   ... View more

Hi @ShahrukhReza that's not configurable in the widger right now.      ... View more

Hi @VenuK Unfortunately, I don't think there's a way to get this done accurately as the description field may contain text like "Protection Pause action initiated on laptop001 and 1 other endpoint". If the endpoint name is not specifically listed in the description, it won't accurately identify the endpoint in the description.   I'd recommend you to create some automation with XDR API's to retrieve the data of endpoints on a daily/weekly basis and compare historically how long an endpoint has remained in an unprotected status. ... View more

Hey All, there's a new version of this page here  -> https://live.paloaltonetworks.com/t5/cortex-xdr-articles/cortex-xdr-postman-api-collection/ta-p/443667 ... View more

Hi @RFeyertag this requires thorough investigation to determine what is affecting the performance (this might not be limited to XDR). Please raise a support ticket with the appropriate logs to determine the root cause. ... View more

Hi @TejasPatil , the disk space utilization is automatically managed by the agent based on the settings configured in the Agent Settings profile. It'd be better if you can clarify why there is a need to manually intervene and clean up. ... View more

Hi @KanwarSingh01 the fields loc_asn and loc_asn_org are missing in line 5 where the iploc stage command is being innvoked. Put it in there and you shall have the information.   See an example:   ... View more

Hi @TejasPatil , continuing on the topic that you'd created earlier here, the recommended disk space is to ensure operational resilience. You are advised to adjust the disk space in your testing environment to validate the same before applying it across the entire fleet. ... View more

Hi @TejasPatil , you can refer to Step3 in this document to identify the amount of disk space alloted to Cortex XDR agents. You can modify the settings in the corresponding Agent Settings Profile to apply to endpoints.    ... View more

Great work there @james.cadet . If anything, it goes to show that you could do it.  ... View more

Hi @Shashanksinha Cortex XDR is a SaaS solution and the HA, DR and its underlying components are managed by PANW. As such, this is transparent to the user with appropriate SLAs. Even during a catastrophic failure on the server side, the agents running on endpoints continue to protect the endpoints with the profiles associated with them via policies alongwith global configurations. The status of all PANW services can be monitored on https://status.paloaltonetworks.com/.  You should consider having a discussion with the designated Accounts team or Customer Success team to better understand your needs. ... View more