About Grady

Grady · ‎06-16-2023

I have the same confusion, but I don't think Paloalto currently has any SNMP interface for SDWAN to get real-time SLA values

Grady · ‎01-29-2023

If you have a Paloalto firewall as an exit, you can use GlobalProtect and enable Enforce GlobalProtect Connection for Network Access to ensure that you must dial into GlobalProtect to access the Internet You can refer to the following connection step 4 https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-portals/customize-the-globalprotect-app If there is no Paloalto firewall, consider using desktop management software like Symantec for control

Grady · ‎01-29-2023

First you need to check if only android users or all users are connecting failed If the connection fails, I think it may be a configuration problem or an operator problem If only Android users fail, you can check if the GlobalProtect portal contains special characters, maybe characters like "_", because I have encountered the same problem before. BTW, Android users should need GlobalProtect License

Grady · ‎01-29-2023

As far as I know, Cortex XDR does not support the function of blocking WIFI connection

Grady · ‎08-10-2022

Hi Marvin At present, I haven't logged into the endpoint to see the trapd.log, because this endpoint is not within my scope, I can only see the failure in the endpoint log from the console, and it still fails when I try to force check-in. The endpoint is connected to the Broker VM

Grady · ‎08-10-2022

Hi Marvin I found that content update failed by looking at the audit log of the endpoint on the cloud console. I just want to know the mechanism

Grady · ‎08-10-2022

Does anyone know the Cortex XDR Auto update mechanism? I recently found that some agents failed to update automatically. The failed content included content update and agent update. The console log did not give the reason for the failure. What are the reasons for the update failure? How often will the content update be triggered again after a failure?

Grady · ‎04-08-2022

I have a security event, I clicked in and found that the CGO signature is unsigned, but when I create an alert exception, it recognizes the signer, why is that? The signature is not recognized, but the signer can be recognized

Grady · ‎03-23-2022

Hi @fmoixsante Thank you for your feedback, is there any news, there is no malicious intent, I just want to ask if this is a bug?

Grady · ‎03-21-2022

Recently, by purchasing a per TB licence, I integrated the logs of the Fortinet firewall, but I found that the daily data volume in the data ingestion dashboard and the log volume in the Fortinet datasets do not match. The dataset of the Fortinet only shows 411G. According to the data ingestion dashboard, the total number should be 592G. I checked other datasets and found no mixing of Fortinet logs. Has anyone encountered this situation?

Grady · ‎03-17-2022

Thank you for your reply, the Fortis dataset has data today, I think it should be caused by the Broker cache

Grady · ‎03-16-2022

Hi Etugriceri I checked unknown_unknown_raw in xql, and I didn't find the data of the tower, this seems to be a confusing problem

Grady · ‎03-16-2022

First of all, I have a per TB license, so today I integrated the data of the fortigate firewall, forwarded it to the broker through the log, and opened the syslog applet on the broker. Configured according to the admin guide, the firewall is given to the broker in cef format. Now the xdr cloud data ingestion Dashboard can see the Fortinet log, but the Fortinet log cannot be seen in the dataset, why is this? Will there be a delay? dashboard dataset

Grady · ‎03-16-2022

Hi Etugriceri Thanks for the explanation, then if I have XDR Pro per TB, I can see firewall logs in datalake, right? For example, can forinet logs be quota in datalake?

Grady · ‎03-16-2022

Hi Bbarmanroy Thank you for your explanation, but there are still some doubts. I understand that the license of 200 pro can store data for 30 days. Does the 30-day data belong to the range of 1TB? What happens if you exceed 1TB

Member Since	‎10-08-2021 12:44 AM
Date Last Visited	‎04-19-2024 12:58 AM
Posts	22
Total Likes Received	4

Online Status	Offline
Date Last Visited	‎04-19-2024 12:58 AM

About Grady

Re: PANOS Secure SDWAN Realtime Metrics

Re: How can i block user to connect wifi using Cortex

Re: Problem with the access to the VPN Globalprotect on Android phone

Re: How can i block user to connect wifi using Cortex

Re: Cortex XDR Auto update mechanism

Re: Cortex XDR Auto update mechanism

Cortex XDR Auto update mechanism

Can recognize Signer but not signature

Re: The data ingestion dashboard and datasets do not correspond

The data ingestion dashboard and datasets do not correspond

Re: How can i block user to connect wifi using Cortex

Re: How can i block user to connect wifi using Cortex

Re: Cortex XDR makes visual studio run slower

What is the manual repair snapshot in the repair suggestion?

Re: Should Advanced Threat Prevention ( Inline ML ) and Wildfire Analysis be enabled if we dont have a decryption policy enabled ?

Re: PANOS Secure SDWAN Realtime Metrics

Re: How can i block user to connect wifi using Cortex

Re: Problem with the access to the VPN Globalprotect on Android phone

Re: How can i block user to connect wifi using Cortex

Re: Cortex XDR Auto update mechanism

Re: Cortex XDR Auto update mechanism

Cortex XDR Auto update mechanism

Can recognize Signer but not signature

Re: The data ingestion dashboard and datasets do not correspond

The data ingestion dashboard and datasets do not correspond

Re: XDR integrates Fortigate but doesn't see data in dataset

Re: XDR integrates Fortigate but doesn't see data in dataset

XDR integrates Fortigate but doesn't see data in dataset

Re: What is the relationship between XDR and Datalake

Re: What is the relationship between XDR and Datalake

Unlock your full community experience!

About Grady