About Balaraju

Greetings Thanks in advance for help  I was trying to find the list of steps to install a Cortex XDR Agent on Redhat Enterprise Linux and guess there are quite a few things and mentioned in different places . Can somebody correct my understanding as listed below , taken from Palo documentation?   1) Check Pre-req -- Processor 2.3 GHz dual-core processor , 4GB; 8GB recommended RAM , Harddisk 10GB , x86 64-bit , Kernel 2.6.32 2)Check compatibility below ( Linux Distribution , version and Kernel version ) https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/where-can-i-install-the-cortex-xdr-agent 3) Verify you have standard Unix programs installed. ( What this means ? ) 4) ca-certificates ( What this means and how to check ? ) 5) openssl 1.0.0 or a later release 6 ) check SELinux status ( # getenforce ) 7 ) glibc 8 )Allow communication on the TCP port from the Cortex XDR agent to server (the default is port 443). 9)Download the Cortex XDR agent installation script from Cortex XDR. You can install the Cortex XDR agent on the endpoint manually using the shell installer or using the Linux package manager for .rpm and .deb installers. Copy the installation package to the Linux server on which you want to install the Cortex XDR agent software. To deploy using the shell installer: chmod +x linux.sh ./linux.sh --proxy-list ”abc.net:8866” The script installs the files for the Cortex XDR agent for Linux in the /opt/traps folder with the Cytool utility available at /opt/traps/bin/cytool. After the agent successfully connects to the server for the first time and retrieves a valid license, the agent begins protecting the Linux server.   Thanks ... View more

Hello    Please share any experience or advice for below situation and how best to approach this .   Currently agents are connected to UK Cortex XDR  tenant via a Broker VM installed on premise . Now the need is to use EU Cortex XDR tenant ,this will be a permanent switch .So can a new Broker VM need to be installed and configured to EU Cortex XDR tenant and then agents be configured to use this new Broker VM ?  will this work ? or any other better way is available . Also should the managing server be changed before changing Broker VM settings on agents or it can be done afterwards ?   Thanks in advance  ... View more

Greetings ,   The single most common and repeating alert which we are getting is like below : '' 173 'Hijacked DLL Injection' alerts detected by XDR Agent on 24 hosts '' Explanation is 'DLL attempted to load from blacklisted location' .So 2 questions here What we are supposed to do here ? What is the investigation path we should follow ? What above alert means ?Should we be worried ? I assume I have read that this protection module  is among those modules which cannot be configured or modified ? Overall looking to understand these type of alerts though they appear as ' Detected(Reported)' and Not Prevented(Blocked) .   Thanks in advance for response  ... View more