About anlynch

Hi @Shashanksinha,   You would be able to see the information about any duplicate removed entries in the audit log.  Please see the link below for further information on the audit log and what can be viewed there that may be of use to you. ref:  https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Monitor-Administrative-Activity ... View more

@mcheung, I don't believe there are any posts similar to this related to MacOS.  This article details windows as it's a more widely used operating system.  I believe the same concepts can be applied to MacOS devices.  I would strongly encourage trying this in a lab environment first. ... View more

Thanks for sharing this with the community @MervynChan  ... View more

Hi @anlynch , You have done fantastic work with this informative and easy to understand blog post. I have one small remark - You were talking about blocking the installation, but you created a BIOC rule. Probably it is good idea to mention that BIOC will only detect the installation (because it runs in cloud console), and you want to use this BIOC to block/prevent how to convert the BIOC to Custom BTP. ... View more

Hi @rufat87 .  If I understand your question correctly you’re wondering why the Alert IDs aren’t in chronological order.  Well, Alert IDs aren’t necessarily generated in chronological order.  It’s possible that these could be analytics alerts or alerts that are aggregated which could explain the difference between Alert ID and Timestamp.  There are several different ways in which Cortex XDR generates alerts and some of these populate quicker than others.  As mentioned above by @Rtsedaka it’s also possible that some of the alerts in questions are informational severity and therefore not displayed in the view in the images you posted.   To get more detailed information about the Alert IDs and their correlations with timestamps I would suggest opening a support case.  You can give them specifics about your environment that may help get to the answer you’re looking for.    https://support.paloaltonetworks.com/Support/Index ... View more