About nsinghvirk

Hello @tejaspatil12    Thanks for reaching out on LiveCommunity! At bare minimum XDR agent require 1.2 kbps bandwidth to maintain its basic working like sending heartbeat to XDR console and keeping the connection alive. However, bandwidth requirement can vary greatly based on factors like size of unknown files being uploaded to Wildfire, number of new files being scanned, amount of data collected from endpoint, size of alert data, size of content updates etc. So bandwidth requirement can vary between few kbps to few mbps.   Please click Accept as Solution to acknowledge that the answer to your question has been provided. ... View more

Hello @Vinothkumar_SBA ,   Thanks for reaching out on LiveCommunity! One of the way by which you can ingest logs from any third party firewall is through syslog collector applet on broker vm. Syslog collector allow you to ingest logs in any of these logs format CEF, LEEF, CISCO, CORELIGHT, or RAW. Please follow below guide to activate and config syslog collector to ingest firewall logs. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Activate-the-Syslog-Collector   One more possible solution is through Cloudwatch integration. XDR provide direct integration to Cloudwatch. Hence if you can forward WAF logs to Cloudwatch, those logs can be ingested to XDR. Below is the documentation for Cloudwatch integration. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs-from-Amazon-CloudWatch     ... View more

Hello @tejaspatil12    Thanks for reaching out on LiveCommunity! Unfortunately you cannot upload a file with multiple hashes in block list. You have to add hashes one by one upto 100. For Import hash exception providing file type column is must. ... View more

Hello @Olivier-C ,   Thanks for reaching out on LiveCommunity! Migration of exceptions between legacy and exception configuration page only changes the view. In Legacy view, you can create and manage exception by going to individual profiles but in "Exception configuration" this can be achieved from central location. I have not seen any impact of this migration on XDR agent's performance.    Please mark the response as "Accept as Solution" if it answers your query.   Regards.   ... View more

Hello @RamyashreeMada    Thanks for reaching out on Live Community! Unfortunately XDR do not control the access for endpoint users. It can prevent malicious activity but cannot control user's access directly. You can use "User risk view" to investigate and assess user behaviour.  With the User Risk view, you can do the following. Assess the user's behavior and score. Review the user's working hours and past alerts. Analyze the user's behavior over time and compare to their peers with the same asset role. Star the user to be included in the watchlist. Please follow below guide to learn more about investigating a user. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Investigate-a-User   Please mark the response as "Accept as Solution" if it answers your query.   Regards. ... View more

Hello @tdemo-user9    Thanks for reaching out on LiveCommunity! Enablement of Host Insight capabilities are directly related to the profiles under which they are enabled. So if you enable host insight capability on a particular profile, it will be enforced on all those endpoints to which the profile is linked. If you have different profiles for different endpoint groups then you can control host insight capabilities to specific groups.   Please mark the response as "Accept as Solution" if it answers your query.   Regards.   ... View more

Hello @Rocky-25    Thanks for reaching out on LiveCommunity. There is no fix time for the release of old subdomain because it can vary from environment to environment. Activation of new subdomain depends on the number of individuals points where a sync is required like firewalls, Broker VM, XDR agents etc. However to expedite the process please raise a case with support team.  Note:- Before you change your tenant subdomain, make sure to complete and validate all the preparations that coincide with the URL change, such as firewall configurations, SSO configurations and Cortex XDR agent upgrades to version 7.4 or later. ... View more

Hello @JasonHoMFT    Thanks for reaching out on LiveCommunity! You are receiving this message because in order to simplify Palo Alto Network devices security logs ingestion into XDR our product team has natively integrated a dedicated data lake within the Cortex XDR tenant itself. This removes the need for separate configuration of Cortex Data Lake. Hence existing integrations should be migrated to the Cortex Native Data Lake. Integrations not migrated manually will be migrated automatically 2 weeks before the end of the contract with Cortex Data Lake. With CDL separation, if you are only using CDL for log ingestion into XDR then you can either manually migrate or wait for the automatic migration as mentioned above. However, if you are using CDL for other purposes then you need to plan for it. Because CDL service will not be available after expiration date if you do not have a separate standalone license for CDL which you can renew further. The migration process should be smooth. If you face any problem please raise a support case. Please follow below document if you want to have manual migration. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Data-from-Next-Generation-Firewall     ... View more

Hello @Pattarachai-FTH    Thanks for reaching out on LiveCommunity! You can use 'join' stage to combine results from two datasets. Please refer to below document to learn about it. There is also an example query included within it. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Join     ... View more

Hello @Vinothkumar_SBA    Thanks for reaching out on Live Community! Deployment of XDR collector depends on what kind of logs you want to collect. If you only want to collect logs from DHCP server as an endpoint from security point of perspective then XDR agent itself collect a good amount of logs. Please refer to below link to see what kind of data XDR agent collects. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Data-Collection However, if you particularly wants to collect DHCP service logs then you can deploy XDR collector or as an alternate can use elastic search filebeat that can be integrated with XDR tenant directly and push logs. More information on collecting DHCP logs can be found in below link. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs-from-Windows-DHCP-using-Elasticsearch-Filebeat?tocId=FWLYuyT54W_un30sGaw9jw   XDR collector is only for log collection and cannot provide prevention capabilities. ... View more

Hello @RFeyertag    Thanks for reaching out on LiveCommunity! Forensics will only be able to collect logs and artifacts from the one machine. If you want to collect  windows event logs from multiple forwarder then you have a option to activate "Windows Event Collector" applet through broker VM. The Windows Event Collector (WEC) runs on the Broker VM collecting event logs from Windows Servers, including Domain Controllers (DCs). The Windows Event Collector can be deployed in multiple setups, and can be connected directly to multiple event generators (DCs or Windows Servers) or routed using one or more Windows Event Collectors. Behind each Windows event collector there may be multiple generating sources. ... View more