About Shahwaz_Md

Hi @Shahwaz_Md ,   Thank you for reaching out to Live Community. Please allow me to address your questions.   1. With respect to whitelist the alert "Large Upload (HTTPS)" detected by XDR Analytics, please be informed that XDR Analytics is not taking any preventive action on this as this is a detection alert and in order to take any preventive action on this you can create a rule accordingly.   2. Moreover, if you are looking to exclude the alert "Large Upload (HTTPS)" detected by XDR Analytics, you can create a exclusion rule under "Settings → Exception Configuration → Alert Exclusions page". For more information you can refer the document: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Alert-Exclusions   3. In addition to above you can also consider configuring Automation Rule to auto resolve the alert or incident generated for "Large Upload (HTTPS)". Document to refer: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Automation-Rule-Actions   Please mark the response as "Accept as Solution" if it answers your query.   Regards, ... View more

Hi,  Thank you for reaching out to the Live Community. Please allow me to address your questions. Based on the verbatim, I could understand that you are looking for the Endpoints which are consuming the license. I would suggest checking in Endpoints> All Endpoints and look for the Agent License Type column. Exporting this report can help you to get the complete list of endpoints with the License type information. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoints-Table Second way is to check in the Widget Library and search for Managed Assets vs Unmanaged Assets. You can use widgets to build the custom dashboard. https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Build-a-Custom-Dashboard   Please mark the response as "Accept as Solution" if it answers your query. ... View more

Hey @Shahwaz_Md ,   Thank you for responding. Per my understanding, you must be referring to the UC module version which is used by Avaya Communication manager which has the latest version on 10.1(GA in 2023) as per Avaya webpages. If this is a custom OS for RHEL, we do not support installation on these as we support native OS distro only. Also, the RHEL 10 is not even released yet so we do not support it as of now.    Hope this clarifies your query.   ... View more

Hi @Shahwaz_Md ,   We do not force a reboot. But if this message is shown that means that a reboot is highly recommended because of some dependent services not being able to remove just in the uninstall. Also, you would need a reboot after reinstall anyways to allow all protection modes to work as we all know there are many modules which do not work unless the endpoint is restarted after install.    Hope this helps.     ... View more

Dear Shahwaz, Thank you for your query. Please note that Agent 8.1 is being released in gradual rollout and will be fully available by 9th of July 2023. If you have any queries specific to your tenant, please reach out to our PANW customer support for further assistance. Hope this helps answer your query, please feel free to reply to this thread if there are any more queries. Thank you ... View more

Hello @Shahwaz_Md    Thanks for reaching out to Live Community.   When you isolate an endpoint, it will halt all network traffic except for cortex XDR traffic. "Response Actions" feature under Agent settings profile allow you to add specific applications to be allowed in case of Network Isolation. Allowing a specific application depends on the customer environment and use cases. There is no recommendation from our side.  For example,  (Windows) For VDI sessions, using the network isolation response action can disrupt communication with the VDI host management system thereby halting access to the VDI session. As a result, before using the response action you must add the VDI processes and corresponding IP addresses to your allow list. Some customer may want Windows Update service to continue to work even in isolation. Some may want to allow access to some other security tool e.g. DLP. Please keep network access to bare minimum in case of Isolation to restrict attacker’s mobility on your network. Below is the link for your reference. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Response-Actions   ... View more

Hi @Shahwaz_Md ,   Cortex XDR agent itself is not listed on Azure Marketplace images. If you need to deploy the agent on Azure VMs via marketplace images, you can choose to create an Azure snapshot containing the installation as golden image and deploy the same snapshot for your Azure VM instances.   Hope this helps!   ... View more