This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About MarvinC
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About MarvinC
05-30-2023
22Posts
7Likes
5Solutions
May 30, 2023Last Visited
User
Activity
User
Profile
Latest posts by MarvinC
| Subject | Views | Posted |
|---|---|---|
| 92 | 05-29-2023 08:56 PM | |
| 115 | 05-28-2023 05:38 PM | |
| 144 | 05-28-2023 05:33 PM | |
| 194 | 05-25-2023 08:29 PM | |
| 304 | 04-11-2023 06:34 PM | |
| 527 | 04-11-2023 06:25 PM | |
| 1363 | 08-10-2022 11:38 PM | |
| 1385 | 08-10-2022 08:50 PM | |
| 1385 | 08-10-2022 08:49 PM | |
| 812 | 07-24-2022 06:42 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 05-28-2023 05:33 PM | |
| 1 Like | 05-25-2023 08:29 PM | |
| 1 Like | 04-11-2023 06:34 PM | |
| 1 Like | 07-24-2022 06:26 PM | |
| 1 Like | 07-22-2022 12:55 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 08-19-2021 07:35 PM |
| Date Last Visited | 05-30-2023 03:56 AM |
| Posts | 22 |
| Total Likes Received | 7 |
05-28-2023
05:38 PM
Hello @sushant1601 , Are you trying to extract Windows Event logs? If yes, you can try the preset = xdr_event_log where you can view the Windows events.
... View more
05-28-2023
05:33 PM
1 Kudo
If BVM is turned off, all the agents are updated (content and version) from the Cortex XDR cloud, Right?
Correct, it will failover to the Cortex XDR cloud if it fails to reach the BVMs.
in case, some endpoints are working remotely (WFH/WFO) will the Cortex XDR cloud provide agents update?
Yes.
... View more
05-25-2023
08:29 PM
1 Kudo
If all the endpoints are on the office internet at that time, is Broker VM required? If you wanted to control your traffic throughput then yes. BVM supports up to 10k endpoints and has caching feature wherein endpoints can get content updates from the BVM.
If we shut down or power off the BVM, what will happen?
Considering that you put the BVM as your Download Source.
The agents will try to connect to the BVM and since it is currently turned off, it will fail.
Once failed, it will go to the Cortex XDR cloud to get the updates.
... View more
04-11-2023
06:34 PM
1 Kudo
Hello @fmohedano ,
This could be a problem on how policy inheritance works.
The inheritance works from top to bottom.
We can resolve your issue by doing different profiles based on their common identified and create exclusion on the Endpoint Scanning if they have a common network share folder.
Unfortunately, due to your requirement for them to be scanned on different hours and different situation -- only 1 malware profile can be inherited at once.
I hope you can open up a ticket or try to reach out to your SE for further assistance.
... View more
04-11-2023
06:25 PM
Hello @ChrisHeath ,
Yes. You can do this by utilizing XQL widgets. XQL widgets results can be attached to a report template and will be sent to your email or generated via console as CSV once successfully generated.
Utilize the XQL queries to get the data that you are looking for.
Here are helpful articles.
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Get-Started-with-XQL
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-Your-Widget-Library
... View more
08-10-2022
11:38 PM
Hello Grady,
Can you somehow drop the error you are seeing?
Is the agent still reflecting in the console? Do you have proxies configured like BrokerVM?
... View more
08-10-2022
08:50 PM
Hello Grady,
Did you somehow check which versions are having trouble upgrading?
For version 7.7, they have already released Cortex XDR Health to check start up and upgrade failures (and roll back)
We are too having issues somehow with upgrade. You can check for TR@PSD logs hints such as storage issues.
But I highly advise for you to contact support and get a support file of the affected endpoints for them to check the root cause.
... View more
08-10-2022
08:49 PM
Hello Grady,
Did you somehow check which versions are having trouble upgrading?
For version 7.7, they have already released Cortex XDR Health to check start up and upgrade failures (and roll back)
We are too having issues somehow with upgrade. You can check for trapsd logs hints such as storage issues.
But I highly advise for you to contact support and get a support file of the affected endpoints for them to check the root cause.
... View more
07-24-2022
06:42 PM
Hi Jaitapkar,
Are you referring to certain feature like Sophos Server Lockdown where you cannot run/install any unauthorized or unrecognized application unless the lockdown was removed from the server and have the list updated.
As of now, there is no similar feature here in Cortex XDR. There is a restriction policy but it does similarly fit to the server lockdown function.
I highly suggest to contact the SE for a feature request regarding this and I'd also be happy seeing this feature in Cortex XDR.
... View more
07-24-2022
06:26 PM
1 Kudo
Hi MithunKT again,
The duplication can be a part of another installation retry on the same endpoint (e.g. reimaging)
What I usually do is to create a widget in Cortex XDR with the dedup filter.
| dedup hostname desc by last_seen
The dedup will deduplicate same hostname but will retain who reported latest in the Cortex XDR console.
... View more
07-22-2022
12:55 AM
1 Kudo
Hi MithunKT, Cortex XDR doesn't show the serial number in the Endpoint Administration section yet if you have Host Insights license the Serial Number can be found in the Host Inventory > Systems Information section.
... View more
06-22-2022
08:01 PM
Hi bbarmanroy, Appreciate your help. In cases that hose firewall is not in use, we have tried BIOC yet it is not applying to restriction profile when we are including IP addresses as a criteria.
... View more
06-22-2022
04:35 PM
Hi Palo Alto Team and Community! I am recently working on Custom Prevention Rules on Restriction Profiles on Cortex XDR. I understand that I need to create user defined BIOC then attach it to a Restriction Profile for it to be a custom prevention rule where I can set it to Block as intended. The problem here is, there are some BIOC that I cannot attach to a Restriction Profile such as BIOC with a hash an external IP address. Are there limitations to user defined BIOC for it to be attached to a Restriction Profile? I managed to create a user defined BIOC that I have successfully attached to a Restriction Profile (e.g. A file create and write user defined BIOC). Would be interesting to know the limitations.
... View more
06-07-2022
04:06 PM
Hi @Shaveta , Hope this can help you! https://docs.paloaltonetworks.com/traps/4-2/traps-endpoint-security-manager-admin/getting-started-with-rules/wildcards-and-variables-in-policy-rules/example-using-wildcards-and-variables-in-policy-rules
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-30-2023
03:56 AM
|
Latest Tags
No tags yet
Likes From
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks