About iscott

Hello, @Sabjul    This year I had the same issue in other Debian/Ubuntu servers. I opened a case with the TAC and after following this process, the services are ok.   - We have uninstall the XDR Agent. Follow the documentation in order to know which method to use. - Rebooted the machine and installed the XDR Agent using - apt-get install ./filename.deb https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-2/cortex-xdr-agent-admin/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux.html - Found services were stopped. (Again). - Started the services using Cytool runtime start all - Could see the agent is reported to the console and services are working.   Hope it helps.   Regards, ... View more

Hello,    I didn't see any deployment in where 2 agents are on the same server. You install one agent, and that agent can monitor up to 100 domain controllers. If you want redundancy, you can install another agent, but on a different server.   I hope it helps!   Regards, ... View more

Hello, @Lucaaslr    If you see an "Application" as "incomplete", it means that the 3-way handshake did not finish.   If you are using a rule-based on "app-id" verify the permission that it has. Above all, the "dns" and "web-browsing" apps. If you have URL Filtering, I recommend checking the URL Filtering logs for the source IP. In order to know if the URL was blocked. Perhaps, this is not the issue, because is cleartext. If the traffic is cleartext you will see a warning from the firewall in the browser. If you can give more details of the issue, it could help.   Hope it helps   Regards,   I ... View more

Hello, @OrkanAlibayli .   Can you check the following?: Obviously review the IP address, Gateway, and Mask. It is important to have the NTP and DNS configured. In order to resolve the DNS requests and sync with the time in the XDR console. Be aware of the token. If 24 hours have been passed, the token is invalid. If you are using a firewall, and it is too restricted, you have to allow URLs and ports from the following link, for the Broker VM IP Address (Required Resources by Region and Broker VM Resources): https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-endpoint-protection/enable-access-to-cortex-xdr/resources-required-to-enable-access-for-cortex-xdr.html#resources-required-to-enable-access-for-cortex-xdr   Sometimes the steps that I mentioned, do not allow successful communication with XDR Console if aren't configured properly. In my case, was the URLs.   Hope it helps.   Regards, ... View more

Hello, @itaymel    Yes, that was something strange to understand when I started with Panorama.   Thanks to share your resolution!   Regards,  ... View more

Hello, @itaymel    Hope you are doing great!   Have you checked the configuration in the firewall?   1. Server Profile (to send logs to Panorama, doesn't apply). 2. Log Forwarding Configuration (in the same profile you can configure to send logs to Panorama and Syslog Server). 3. Have you attached the Log Forwarding option to Security Policies? 4. Also, have you verified if the Firewall is managed by the Panorama Server after the upgrading?   Panorama > Log Settings does not apply because these are logs from Panorama, that you want to send to external services:   https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/panorama-web-interface/panorama-log-settings.html   Regards, ... View more

Hello, @MP18    I have found the command "show system disk-space". I have run it and it showed me the total amount divided into partitions. It is because the GUI just shows the amount related to logs.   Thanks for your help.   Regards, ... View more

Yesterday, I have logged with a "SuperUser" account. It was the "admin" user (default). But, when I browse to Device > Administrators, the user's accounts didn't appear. Just the "admin" account. Also, I was not able to create a new user.   I need to change the LDAP's user privileges. Currently, LDAP users can log in to the web interface, but they do not have "SuperUser" permissions. Where can I change it? Where can I see the LDAP firewall's administrators?   Regards,  ... View more