About Grady

Hi @Sulthan.Ibrahim ,   Please mark the response as "Accept as Solution" if that was able to help you. ... View more

First you need to check if only android users or all users are connecting failed If the connection fails, I think it may be a configuration problem or an operator problem If only Android users fail, you can check if the GlobalProtect portal contains special characters, maybe characters like "_", because I have encountered the same problem before. BTW, Android users should need GlobalProtect License ... View more

Hi Grady,   Would you please open a support ticket with our Customer Support team to review and fix the problem?   Thanks, Silviu ... View more

This looks like a bug. Can you please raise a support ticket with the screenshot and an alert dump of one alert where you're seeing this behavior? You can retrieve the alert dump by right-clicking on an alert, Retrieve Additional Data -> Retrieve Alert Data.   ... View more

Hi @fmoixsante    Thank you for your feedback, is there any news, there is no malicious intent, I just want to ask if this is a bug? ... View more

Thank you for your reply, the Fortis dataset has data today, I think it should be caused by the Broker cache ... View more

Yes. totally correct. Panw firewall can able to send logs directly to CDL. for any other type of logs, you are able use BrokerVM , XDR collector, XDR API and FileBeat.  if log type does not known by XDR, You need to write your parser rules on XDR management console and last things, logs will be searchable by using XQL and will be ingested    XDR log rotation date is 30 days. You don't need to concern if you exceed 1TB.  This is SAAS service. Please check you average daily log size from XDR Management console > Configurations > Dataset management. Filter out "dataset name = xdr_data" if your license is not enough for keeping 30days xdr data, you may choose to increase your license. But sizing calculator is pretty accurate.  ... View more

Hello   You can generate trapd.log in the relevant terminal for analysis. My terminal analysis result is that VS is slow because XDR detects Citrix and causes VS to get stuck and crash. It is recommended to find the corresponding crash file name or path and whiten the BTP module ... View more

Sorry,I re-edited the question ... View more