This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About zarnous
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About zarnous
01-18-2023
6Posts
1Like
2Solutions
Jan 18, 2023Last Visited
User
Activity
User
Profile
Latest posts by zarnous
| Subject | Views | Posted |
|---|---|---|
| 166 | 01-11-2023 09:16 AM | |
| 2236 | 03-06-2022 06:22 PM | |
| 1709 | 03-06-2022 10:00 AM | |
| 1789 | 03-05-2022 03:01 PM | |
| 2253 | 03-05-2022 09:54 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 03-05-2022 09:21 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 2 Likes | |||
| 2 Likes | |||
| 33 Likes |
User Badges
Community Statistics
| Member Since | 12-15-2020 05:27 AM |
| Date Last Visited | 01-18-2023 09:08 AM |
| Posts | 6 |
| Total Likes Received | 1 |
01-11-2023
09:16 AM
For the time being , XQL doesn't support Incident and Alerts ingestion on XDR platform, hence, creating a custom widget related to incidents is currently not an option with Cortex XDR; however this option is available with XSIAM where there is datasets for incidents and alerts
... View more
03-06-2022
06:22 PM
do you happen to notice any CPU spike when you start Visual Studio? , and also if you identified the scope of the issue (on how many endpoints) and they all experience the same, then i would have a TAC case open to look at this specific issue and run some analysis, you may proactively collect some logs from one of the impacted endpoints and submit those to your ticket, something like: 1. Raise the log level - cytool trace stop cytool trace set all verbose 0x7FFFFFF cytool trace start 2. Run ProcMon, and reproduce the issue in full 3. Save the ProcMon capture and close ProcMon. 4. Turn off / exclude the responsible component 5. Run ProcMon again to capture the behavior. 6. Collect the agent support file & .PML files. 7. Reset the logging level - cytool trace stop cytool trace reset cytool trace start And have those uploaded to the TAC case for further analysis.
... View more
03-05-2022
03:01 PM
Just a quick note, JOIN - combines data into new columns. UNION - combines data into new rows So if i understood your use case correctly , i may do it somehow like the below: dataset = microsoft_dhcp_raw | filter hostName != "" and ipAddress != "" | alter hn1 = split(hostName ,".") | join (dataset = endpoints ) as EP EP.endpoint_name = hostName | dedup hostName | dedup ipAddress and this shouldn't return any run error , and if a match found by the hostname you should be able to see that in the result pane. I hope this helps.
... View more
- Tags:
- XQL
03-05-2022
09:54 AM
I haven't encountered this behavior, but i would take a step back and verify the below: 1- The endpoint is meeting the minimum requirement to run the agent (the higher the better) , this can be found here 2- Verify if another Third-Party Security Products running alongside XDR on the endpoint, since this may cause performance issues and some unexpected behaviors, more info can be found here I hope this helps.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks