About Shashanksinha

Where can I find agent agent upgrade rollback plan for failed upgrades in cortex XDR?   ... View more

Is there any option in Cortex XDR, where we can check which all hosts have a specific exe present?  For eg We want to get a list of hosts which has google chrome installed in it.   Regards, Shashank ... View more

Hello Team, Since the new version of Cortex has come out 3.6 version.  Wanted to get clarity on auto -the agent upgradation part.   Is it recommended to upgrade your agents(servers/workstation) to N-1 or latest version via auto agent upgrade policy?'   If yes then can you help in collecting information for below mentioned Q's'   1.What to do if agent gets corrupted during agent upgradation? 2.Impact on Operation during Agent upgradation on servers or workstations? 3. Rollback Plan feature is available ?incase of failure of agent upgrade.   Regards, Shashank ... View more

We are facing trouble installing Cortex xdr on one of the LInux server nor able to geenrate logs. Attaching error picture for  reference.   ... View more

Hello, Where can I find malware test samples to test cortex XDR capabilities? ... View more

Is it possible to group alerts which are not part of incident ? Regards, Shashank ... View more

We are unable to see exact agent version details for the Operating system Windows Server 2008 Version 6.0(Build 6003:Service Pack2) in the compatibility matrix sheet by Palo alto only about Windows Server 2008 Version 6.0(Build 6003:Service Pack1) is mentioned there. Kindly help us with which exact cortex agent version needs to be installed on this server => Windows Server 2008 Version 6.0(Build 6003:Service Pack2) Since it is a 2008 server it has no support . Also educate us on what procedures and requirements are needed while installing the cortex agent on this OS version. Regards, Shashank ... View more

Hello, Can you please help with the below query. What happens if we install more agents than the license and do those extra agents not work with maximum capabilities? If yes then what are the capabilities that don't work?   ... View more

Hello,   For Scans applied through polices for the pending machines how long the scan command remains upon scan initiation. for eg: I enabled scan policy on Monday the system was in disconnected state on that day and it comes back online on Thursday will the policy applied to it and initiate the scan on that system. Note: The policy will be not disabled. Few scan are getting failed due to the user cancel scan manually. Is there any notification sent to the user once the scan is initiated. if yes is there any way to disable the notifications and is there any option to disable the access to the user to cancel the scan. ... View more

Is windows os 2008  compatible for the installation of Cortex XDR ?  Windows server 2008 and windows 8, windows 8.1? All Windows 8 variants are supported until January 2023 (Microsoft EOL + 3 years). Release 7.9-CE offers continued support for Windows 8.1. ... View more

How to fine-tune the incidents similar incidents. We have added the hash and file path of such incidents on allow list and used the feature to exclude alerts. Still, we see incidents getting triggered.   ... View more

Hello Team, Can you please help us with some latest use cases. And if possible Industry-Specific Use Cases focusing on the finance sector.   Also how to fine-tune similar kinds of incidents? Tried to whitelist the exe but incidents still trigger. ... View more

Hello, Even after installing cortex xdr on linux server it is not reflecting on console . We have tried to cytool reconnect force ,we checked comaptible(it is compatible) we tried runtime stop/start command as well. The services dypd, analyzerd and ited are not in running state no matter what we do. Please help in resolution of this issue. Regards, Shashank ... View more

What is the difference between canceled scan, pending cancellation  and pending scan with respect to endpoint scaning ?   None: No scan initiated Pending- Scan was initiated ,waiting for action to reach endpoint In Progress- Scan is in progress Success-Scan Completed Pending Cancellation-Scan was aborted,waiting for action to reach endpoint Canceled-Scan canceled Error-Scan failed to run System Uptime-Length of time since last device reboot. Aborted scan- Regards, Shashank ... View more