About PeteJacobCF

This stinks that it is for pro only. This should be available to all regardless of license pro or prevent. having the cortex agent loaded is the best way to have the product and your customers most successful.  ... View more

I only do the minor release automatically.  having said that I do test out new versions on key assets (servers, workstations, supported builds of win10 and apple).   Once I am ready to roll out a major version I use either the platform to push to my different sites or sometimes manually and sometimes, use the auto update feature only to turn it off once I have my assets on the new version I am going for. I have found that using the auto update feature sometimes will just stop working for whatever reason (kind of annoying).   I then have to go back to my RMM tool and ensure that it is installing that new version for new/freshly imaged assets. ... View more

I think all you can really do is to follow this page for compatibility, looks like it was just updated on 10/14 https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/where-can-i-install-the-cortex-xdr-agent.html   We have some win11 and 21h2 slowly creeping into our environment, not sure what the official word is on cortex validation for new OS's. ... View more

just curious why you would not block (at lease the file name) based on hash? (seems safest). ... View more

not really adding much value here but I feel the exact same way. I am thinking I should just deploy v7.5.1. I wished that with the cortex versions there was a preferred version like with pan os. ... View more

yes exactly. I was simply saying that we have had some good success finding our users "password" files... meaning txt or .doc files users use to store passwords and usernames in. I was not saying this would find password protected files...  ... View more

simply searching for the word "password" in the file name has really worked well for us and it is also what most of our pentest engagements use. ... View more

the DC's and devices you have the user agent service on need to have that same patch loaded. ... View more

I think it is KB5003671 but might depend on your host OS. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Vcg I am running different OS's for my user agent servers and my DC's so I just made sure they both had the june 2012 security patches.    not sure if this whole thing was a bug or some communication I missed. ... View more

thanks for the help guys.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Vcg ... View more

I have a ticket in since this morning and it's still in queue. Can anyone confirm there is some sort of hot fix or know what the technical issue is that is causing this?   this is really a mess ... View more

having the same issue, is the patch on the support software updates section? I am seeing broke version 9.1.2.9 ... View more