About epalcev

This is a great solution, it's a shame that it's Pro/TB and MS DHCP but it's a great solution.  ... View more

Hi @Daniel_Itenberg  This is something that requires more deep investigation. Can you please open a support ticket and don't forget to attach the logs from the Broker VM?   Let me know if I can assist with something else. ... View more

I was looking for a way to exclude behavior protection from the IP address that is used by the scanner. ... View more

This is most likely because your Thunderbolt dock is not a disk drive, but a dock/hub.    You can try the following sequence to see if this works for you: 1. Verify if the Thunderbolt dock connect/disconnect action in is being detected via the following XQL query: dataset = xdr_data | filter event_type = DEVICE and event_sub_type = DEVICE_PLUG | fields action_device_usb_product_nam   If you're able to verify the dock is getting registered as a USB device, proceed to the following steps: 2. Add the Thunderbolt dock serial number/GUID under Policy Management -> Settings ->  Device Management. 3. Add the device your Device Configuration Profile under "Custom Device Type" and Action as "Block".       Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/hardened-endpoint-security/device-control.html ... View more

To add, the Pro/Prevent backend is the *exact same.* So really all the change that occurs is PAN allows you to check the "Pro Endpoint Capabilities" box, and then that data is now feeding the data lake and you are seeing more of it in the console. Have migrated many customers to pro, since you already have agents deployed most of your heavy lifting is done already. ... View more

Hi Epalcev,   Thanks for the reply!   The file was not quarantined. Actually, the file was present in the temp folder and I confirmed with the user, he deleted the temp files yesterday. So, that might be the reason the file was not present in the system. ... View more