About RonaldWeiss

Same here...   ... View more

So, nevertheless the install_date as string is hard to filter by date. To resolve this, parse_timestamp might be a solution, but i dont get how it works... The install_date string is "2022-08-11" which i'd like to convert to something filterable like "Aug 11th 2022".     ... View more

Perhaps this might be what you want:   config case_sensitive = false | dataset = host_inventory | arrayexpand kbs | alter kbnr = json_extract(kbs , "$.name"), install_date = json_extract(kbs , "$.installation_date") | fields host_name, kbnr , install_date |dedup host_name by desc install_date | sort asc install_date     and after that, perhaps a "|limit 50" ... View more

Hi, this might work. But if there is a deb package provided, it should work as expected, and not unveil as a renamed tar.gz. When you follow the part "To deploy using package manager" on your screenshot, this simply doesnt work. AND: the deb was working since 7.6!   To clarify: i AM able to install a tar.gz, but there is the fact that the deb installer is not working as expected. So i think someone messed something up. The Intention of the post is to inform about the failing installer.   PA should either change the manual below "To deploy using package manager" (add "unpack the *.deb using tar -xfz, and copy the config file"), and get the laughts of every linux-admin, or just fix the creation of the deb file. ... View more

Hello, as Luc mentioned here (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/m-p/496106/highlight/true#M2073 ) the use of custom prevention rules  with the BIOC works lika a charm here. So, this will be my solution until PA or Microsoft deliver a proper one. (Which, for PA, might be a BIOC, too 😉 ) ... View more