About afurze

Hi Cyber1985,   First, the Broker can handle up to 10,000 endpoints so 100 servers is not a stretch.  You may want to consider deploying two Brokers and then providing both as proxies to your servers for redundancy.  This is configured via Endpoints -> All Endpoints, select the servers and right-click -> Endpoint Control -> Set Agent Proxy, you can specify the IPs and ports for both Brokers and then the agents on these servers will be able to use either one.  You don't directly do "HA" configuration in the Brokers or XDR Instance as they Brokers do not need to communicate with one another, just provide both as proxies for your agents and you will be ready to go.   Second, you can absolutely use the Live Terminal when an agent connects through a Broker. ... View more

Hi Bojan-Totic,   Unfortunately, at this time, Incidents and Alerts are not exposed as a dataset and therefor cannot be queried using XQL.  The only available dashboard and report widgets related to these are those that come out-of-the-box.  That being said, you can query Incidents and Alerts via the public API so you could import this data into another reporting tool to produce what you are looking for. ... View more

1) This is a feature of Threat Intelligence Management from Cortex XSOAR, you can ingest lists from Palo Alto Networks and other 3rd party sources and pass them in to Cortex XDR.  You can reach out to your account/sales team for details   2) Cortex XDR BIOCs as well as Analytics BIOCs are already tested against well known, safe, activity to reduce false positives, there is no action required for most out of the box Windows systems.  If you are encountering false positives related to known trusted Windows processes, you can utilize the concepts discussed in the alert tuning webinar to implement appropriate exceptions/exclusions ... View more

Hi CraigV123,   With Cortex XDR Prevent, only the XDR Agent information can be ingested into XDR console, an XDR Pro license allows you to ingest alerts from 3rd party sources (including NGFW) and a Pro per TB license allows you to ingest the raw logs.  Please refer to this doc page with detailed information on capabilities per license type (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licenses/features-by-cortex-xdr-license-type#features-by-cortex-xdr-license-type).   Correction: You can use the AD integration feature to bring in data from AD for alerts and incidents.  It's the Identity Analytics that you won't be able to utilize.  Check out https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-cloud-identity-engine for information on configuring this. ... View more

Hi Luc_Desaulniers,   Unfortunately, there is no way to rollback a CU or to deploy an old CU from the console. ... View more

Hi Cyber,   Please reach out to your SE/Account Team to get this feature request submitted for you!  It isn't 100% relevant to that particular view since that lists all artifacts involved in an incident, not necessarily the response that was taken for them as that is instance/endpoint specific (which is why it shows up in the Executions tab), but it may still be something that could be summarized in that view. ... View more