About dgagnon

dgagnon · ‎02-15-2023

I noticed a similar trend with systems in our environment. When looking at the logs of a specific endpoint and the comparing activity of others, the cyserver service gets stopped when Cortex XDR performs a policy update. These two events are usually within 1 minute of each other. If you did open a ticket, I'm sure others here would like to know what the official resolution was to the question.

dgagnon · ‎04-25-2022

Does anyone know if there's a way to search for rules within the Palo Alto which have packet capture enabled? I'm trying to see what rules currently collect PCAP and disable the collection of pcap data for noisy signatures.

dgagnon · ‎02-18-2022

I am reviewing my organizations XDR licenses and noticed that the dashboard seems to be reporting an inaccurate amount of licenses used. We only have 146 endpoints in our environment. We have approximately 125 non-persistent VDI workstations. However, the dashboard shows 520 licenses have been used. When filtering for connected devices, I only see about 130 endpoints. The others show a status of 'disconnected' or 'connection lost'. Is there a way to have the dashboard properly reflect the number of endpoints? According to https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/cortex-xdr-prevent-overview/cortex-xdr-licenses/cortex-xdr-license-allocation.html " In the case of non-persistent VDI, the Cortex XDR agent registers with Cortex XDR as soon as the user logs in to the endpoint. " Does this mean that in a non-persistent VDI environment that licenses get assigned per log on session?

dgagnon · ‎01-27-2022

Hi @kiwi That does help to provide some additional context to the text within the pop-up menu. The challenge is trying to determine if there are inaccuracies in the description. For example: the pop-up box says "if you enter the domain as xyz.com/, you will only allow xyz.com." and the link you found says "google.com/ - will match only google.com" on line 8. This lines up with the example provided from the pop-up. However, on line 5 from the link it says: " *.google.com/ - will match blog1.blog2.google.com but will not match google.com" This is where I'm a little confused as I'm struggling to understand why the line 5 example would only match a domain name with sub-domains and not the domain AND any other sub-domains. I'm inheriting a poorly managed firewall and if line 5 is correct, if I want to block badsite.com and any other subdomains on that site (download.badsite.com or chat.badsite.com) I will need to have two (2) entries in the filter: badsite.com/ and *.badsite.com/. I want to ensure I'm applying these rules properly and not inadvertently permitting access to site we're trying to block or preventing access to sites we need to allow.

dgagnon · ‎01-26-2022

I'm trying to have a clear understanding of wild cards and ending tokens when using them for custom URL categories. What's the difference in behavior when using *.site.com/ versus site.com/ ??? The pop-up doesn't seem to mention wild cards in the scenario. "if you want to allow xyz.com and enter the domain as 'xyz.com,' you will allow xyz.com and URLs such as xyz.com.random.com. However, if you enter the domain as 'xyz.com/,' you will only allow xyz.com." Some of the threads here haven't been clear on the differences.

Member Since	‎01-10-2022 06:50 AM
Date Last Visited
Posts	5

About dgagnon

Re: Cortex XDR service getting stoppage on machines

Listing PCAP rules

Understanding xdr licensing

Re: Clarity with wildcards used for custom objects

Clarity with wildcards used for custom objects

Re: Cortex XDR service getting stoppage on machines

Listing PCAP rules

Understanding xdr licensing

Re: Clarity with wildcards used for custom objects

Clarity with wildcards used for custom objects