About Luc_Desaulniers

Are you 100% sure of that?   This is what logically should happen, but I ran into the exact issue that the OP is referring to where a CU was pushed, broke things, the next day it got fixed by a new CU, but my machines that were set to a 3 days delay picked up the broken CU first.   This happened to my environment back in early March 2022.   Maybe things have changed now, but I can confirm that OP's concern is a valid one as I've seen it happen. There is no way for us customers to exclude a content update. What I ended up doing was work my way around it by changing the delay to a very long delay and then once I was sure the latest wasn't causing issues, I switched my initial group that had the delay setup to immediate content so they would pick up the latest one and then changed it back to 3 days delay once they were all to the point I wanted them. ... View more

It is normal in the fact that this how it's done currently, but now is it secure to do this, no it isn't. Try to raise it through a support ticket, I guess the more that raise those kind of issues the more chance there is for Palo Alto to fix it. ... View more

Great start on the query. Here's another way you could do this to avoid an and statement: config case_sensitive = false |dataset = xdr_data |filter event_type = ENUM.PROCESS |filter action_process_image_name = "msdt.exe" and action_process_image_command_line = "*PCWDiagnostic*IT_RebrowseForFile*" |fields agent_hostname, action_process_username as User, action_process_image_name as Child_Process, action_process_image_path as Child_Path, action_process_image_command_line as Child_CMD_Line, action_process_image_sha256 as Child_SHA256, actor_process_image_name as Parent_Process, actor_process_image_path as Parent_Path, os_actor_process_command_line as Parent_CMD_Line ... View more

You could create a BIOC rule with that query and then assign this BIOC rule to a restriction profile so that it would prevent the action. It does the trick usually, keep in mind that BIOC rules aren't instantaneous, but depending of the actions, it usually reacts quickly enough to avoid most of the damage. ... View more