About Vinothkumar_SBA

Hi @Vinothkumar_SBA    Thank you for writing to live community! If I understood correctly there is an IOC in XDR whose alert was generated by Alert source as XDR IOC, but those IOC were prevented by PANW firewall do you mean this?  Since IOC was reported as Detected by Cortex XDR agent therefore  action_network_success which corresponds to that alert has/had value false.  Could you share what discrepancy you see with the Detected alert and action_network_success as false? Additionally you may also can verify NGFW event by running XQL query for preset = network_story dataset and then look for events related to that IOC Alert. Then you may check the "action_network_success" field value.   Thanks   Hope this helps! Please mark the response as "Accept as Solution" if it answers your query.     ... View more

Hi Nijith, - Cortex XDR Pro per GB—Amount of total storage included with your license.   - Cortex XDR Pro per GB An innovative solution incorporating data ingestion from multiple sources for effective detection, security analytics, and response platform based on the Cortex XDR Pro per Endpoint license. With the Cortex XDR Pro per GB license, in addition to collecting endpoint data, you can ingest numerous data sources for complete visibility over your network traffic, and user behavior. Applied together with the Cortex XDR Pro per Endpoint license the enhanced endpoint and third-party data ingestion, the Cortex XDR Pro per GB provides streamlined investigation techniques and extensive remediation analysis capabilities.   To expand your license capabilities, Cortex XDR offers several add-ons on top of the Cortex XDR Pro licenses that allow for more granular investigation.   Cortex XDR Pro per GB 30-day Ingested Data 180-day Alert and Incident Data Incident and alert data are retained according to the last Update and Creation dates, respectively. Data collected within these dates is kept and displayed for 180 days. To ensure the accuracy of incidents, Cortex XDR provides a grace period of up to 30 days for alerts displayed in the Incidents View, Alerts table, and Casualty View.   Please help out other users and “Accept as Solution” if a post helps solve your problem ! Read more about how and why to accept solutions https://live.paloaltonetworks.com/t5/general-topics/how-and-why-to-accept-a-solution-to-your-post/td-p/552976   ... View more

Hi @Vinothkumar_SBA , As you can see from the requirements listed here - https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-release-notes/cloud-identity-engine-release-notes-welcome/cloud-identity-engine-release-notes-system-requirements You need to install the agent on server that has connectivity to the AD ... View more

Hi@PiyushKohli, We have configure the API integration. ... View more

Hi thanks for your information please clarify one more question. in-place operating system upgrades that means. ... View more

@Vinothkumar_SBA, I'm kind of confused on what your question is to be honest. Do you need to have the exception for the next 200 days, or are you thinking that you need to set it to how long you've been using XDR? The exception time frame just needs to match how long the exception will be required, not how long you've been using XDR. In the event that you actually need to set the device with an exception for 200 days, you would simply add the device to the permanent exception list. You'd need to manually create a calendar entry or something to remove the device exception once it's not needed anymore instead of relying on an automated removal. Alternatively, you could use the API and setup a script to remove the exception once the 200 days has passed; that would obviously be a lot more work than simply creating a calendar entry, and you'd want to be familiar with the API if you pursue that process. ... View more

Hi @Vinothkumar_SBA ,   There is no change for the retention after license migration from "per TB" to "per GB". As explained here - https://live.paloaltonetworks.com/t5/general-topics/cortex-xdr-firewall-configuration-query/td-p/547833  "per GB/TB" license are ingestion only, meaning they don't effect retention periond.   Which means you should have (by default) 30days of hot retention for ingested data and 180 days of hot retention for alerts and incidents (created by XDR). If you need extend that you need to order license add-ons, details for which you can see in the link above. ... View more

@Vinothkumar_SBA, I don't think you'll have success trying to get this into PDF format, as you'll end up getting it cut off. The PDF capabilities similar to other PAN products are fairly limited when it comes to displaying large amounts of data; you'd be better of getting the CSV and having some automation to convert it to a PDF if that's truly needed.  ... View more

Thank you for the response! ... View more

Thanks for your Answer.   ... View more

Thanks for your response.   ... View more