About nsinghvirk

Hello @Vinothkumar_SBA ,   Thanks for reaching out on LiveCommunity! Please confirm how your linux virtual machines are working, whether as a standard VM or as temporary session where multiple users can access the system. You can install XDR agent on linux machines in either standard installation or as temporary sessions. For standard installation, each Linux server receives a single license which includes protection for container processes. But you can also deploy Cortex XDR agents on virtual Linux servers as temporary sessions, to ensure the Cortex XDR agent license returns to the license pool after 90 minutes of session inactivity. Please identify what is your exact use case and deploy accordingly. You can add below options to your installation command line to install XDR on temporary sessions. Pre-install—Install the Cortex XDR agent only on the Linux endpoint you are using to create the VM template. Every instance you create using this template, will include the pre-installed Cortex XDR agent. For example: $ ./installer.sh -- --vm-template Fresh install—Install the Cortex XDR agent on the Linux VM after creating the VM template, as part of provisioning. For example: $ ./installer.sh -- --temporary-session   Reference - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.5/Cortex-XDR-Agent-Administrator-Guide/Install-the-Cortex-XDR-agent-for-Linux ... View more

Hello @Joe_Carissimo    Thanks for reaching out on LiveCommunity! In this case you can create your own dynamic endpoint groups based on either specific tags that you will assign to endpoints that are managed by Intune or you can dynamic groups based on their cloud id and cloud info fields. Similarly you can choose other parameters like IP subnet etc.   Dynamic groups - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Define-endpoint-groups?tocId=v0IAL2Jkd2taWhL8ep3jHg   Please click Accept as Solution to acknowledge that the answer to your question has been provided. ... View more

Hello @cylusaragao    Thanks for reaching out on LiveCommunity! Below is a reference query which you can use to build correlation rule to generate alert. dataset = xdr_data | filter event_id contains "4728" | fields action_evtlog_description , event_timestamp , action_evtlog_normalized_user   Correlation rules - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Correlation-rule-details Notification forwarding - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Configure-notification-forwarding    Please click Accept as Solution to acknowledge that the answer to your question has been provided. ... View more