This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
About RFeyertag
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About RFeyertag
06-23-2022
9Posts
0Likes
1Solution
Jun 23, 2022Last Visited
User
Activity
User
Profile
Latest posts by RFeyertag
| Subject | Views | Posted |
|---|---|---|
| 104 | 06-23-2022 12:09 PM | |
| 173 | 06-22-2022 02:21 PM | |
| 122 | 06-22-2022 02:05 PM | |
| 45 | 06-22-2022 01:53 PM | |
| 122 | 06-22-2022 01:20 PM |
User Badges
Community Statistics
| Member Since | 08-15-2021 09:12 AM |
| Date Last Visited | 06-23-2022 03:49 PM |
| Posts | 9 |
06-23-2022
12:09 PM
Sorry, I don't get it. How would you type in, if i want to check exactly following string. "C:\Windows\System32\hh.exe" C:\Program Files (x86)\ASSA ABLOY\Vision\Vision.chm::/Use_Guest_CheckIn_Steps_Single.htm BR Rob
... View more
06-22-2022
02:21 PM
Hello dear community, is there a way to put the whole command line into the XQL query? As you can see the doublequotes are already set by the command line itself. In SQL I know to do it whith extra double quotes ""XYZ"". But how does that work with XQL? BR Rob
... View more
06-22-2022
02:05 PM
Hello dear community, has anyone of you a XQL Query for this type of attack? https://www.bleepingcomputer.com/news/microsoft/new-dfscoerce-ntlm-relay-attack-allows-windows-domain-takeover/ BR Rob
... View more
06-22-2022
01:53 PM
In our case the sessions are lost, when we reboot the RDP-Server. The session only persits, when the employee disconnects its RDP-Session. But all the changes in the logged out and OS restartet sessions are persistent. A user can have X sessions with the same user, without disconnecting the other sessions. Sorry, my knowledge about Terminalserver needs improvement. BR Rob
... View more
06-22-2022
01:20 PM
From point of the technical aspect, I have no clue how the process can be in a real life scenario. Is there any ressource existing, where we can ask how to setup our Cortex XDR for a good practise way belonging to forensics incidents? I know in the end, we will have a team of forensics persons in the house, which will need informations quick. Therefore I thought we will collect every day forensics data from all endpoints. To divide them to endpoint forensic and endpoint non forensic is not solved well. I would like to see a type of tag to be more flexible without putting the client/server to another endpoint group/policy/profile and dividing the inventory. So now for my understanding, the triage is the function, which collects all forensic data based on the agent settings to the console/Host Timeline? When the collector in the agent settings is set to 12 hours, what will haben with this data? Is it collected, but the clients needs triage flag to get the informations to the host Timeline? BR Rob
... View more
06-15-2022
11:55 AM
Hello dear community, how do we use this addon? I had found a article about the forensics addon which said, you can also put this feature to an client/server after the incident etc. happened. What is the difference between having this addon for all our servers/clients active or to put this profile to our client/server after a real incident which needs a forensic investigation to dig deeper. How and when does the addon pull the forensic logs, when clients are offline and they get online only for 8 hours? Does it happen when the client is turned on? We do really want to know if we need to buy more licences for this addon or if it is not neccasarry. Thanks a lot! BR Rob
... View more
06-15-2022
08:08 AM
Hello dear Community, with our CSP we had some discussions about the installation on a Windows Terminal Server (Round Robin). Do we have to use the TS_ENABLED=1 flag to install the cortex agent on the Terminal Server? TS means hier temporary session and not Terminal Server. But has Terminal Server a temporary session? https://docs.paloaltonetworks.com/cortex/cortex-xdr/5-0/cortex-xdr-agent-admin/traps-agent-for-windows/install-the-traps-agent-for-windows BR Rob
... View more
04-15-2022
05:33 AM
Hello to ALL! I found the mistake. It was my fault. I didn't check the period in the top right corner when writing the query *shame on me* The network_story works like the agent_network_story! Thanks you very much for the help! BR Rob
... View more
04-08-2022
04:39 PM
Hello XDR Community! when the network (see screenshot) will be depprecated, will it be possible to get all the informations under network connections? I don't get the same results and not dst_host which would be very usefull. Here is my Query: Network [ action type = all AND remote ip = XXX.XXX.XXX.X ] AND Time [ event timestamp in last 24H before Apr 9th 2022 01:03:51 ] Has anybody of you a future proof XQL version of my query above? BR Rob
... View more
- Tags:
- XQL
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-23-2022
03:49 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks