About dfalcon

Hi @Elroykhlo-   I have seen Cortex XDR installed alongside Carbon Black during evaluations with no issues.   Third party products with known compatibility issues can be found here:   https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/cortex-xdr-compatibility-with-third-party-security-products.html   Hope this helps - please let me know if you have any questions. ... View more

Hi @RomainCouvreur-   The XQL xdr_data dataaset does not include alert data.  Until that dataset is exposed, the easiest way to look for the rare cases that need your attention is to filter for XDR agent and post detections in the alert table as shown below.     ... View more

Hi @RomainCouvreur-   I'm not sure I understand the ask.  Are you looking for a report that shows you malware events (to include the host) that need your attention?  Or do you want to see all hosts that had malware events that also may have had preventions? ... View more

Hi @efasoformoso-   The device control feature is designed to enforce USB-connected devices.  If the device is connected via an external SD reader, you may be able to block - I would need to test to verify.  You can also block execution from an SD-card by leveraging a restriction profile regardless if the reader is embedded or external.   You should be able to block the printer.  Here is a list of Windows portable device classes (provided by Microsoft) that Cortex XDR can block.     https://docs.microsoft.com/en-us/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors   Additionally, you are able to create custom device classes.    Hope this helps. ... View more

Hi @KRisselada-   I spoke with one of the Product Managers.  For these types of emails, the changes will apply to all tenants across the board.  All maintenance is conducted outside of what is considered normal working hours for the given region.  Unless otherwise specified in the communication, there should be no outage.   ... View more

Hi @KRisselada -   I will share this feedback with the appropriate Product Managers today.  As an FYI, this update will apply to all tenants. ... View more

@WSeldenIII is correct.  You would just need to use the Agent Installed = No filter under Assets > Asset Management.     ... View more

Hi @CraigV123-   While I'm not an end-user / admin, I can speak to its functionality.  For Cortex XDR Prevent environments, Directory Sync allows the ability to leverage AD OU's and groups to assign policy.  This may or may not help much depending on the use of different policy rules for groups.  For Cortex XDR Pro -- Directory Sync serves a much deeper role.  In addition to the policy benefits, Directory Sync provides the data needed for event context enrichment.       ... View more

Hi @Marcelo_Campos-   The amount of space used varies.  There are no signature files which take up space.  The agent setting sets the maximum amount allowed -- then it is first in first out.  Most of the consumption will be found in c:\programdata\cyvera ... View more

@KRisselada is correct.  ... View more

Hi @jgchang8 -   I checked with the Product Management team.  Big Sur support will not be added to Traps 4.2.  All subsequent macOS versions will be addressed with Cortex XDR. ... View more

Hi @jgchang8-   I will check with the agent Product Manager and let you know.  The most current content will be available here.    https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/where-can-i-install-the-cortex-xdr-agent.html#where-can-i-install-the-cortex-xdr-agent ... View more

Hi @BillStrahan -   For this very "installer," the Trusted Publisher feature was introduced over 4 years ago.  The Trusted Publisher feature should allow the installer to run.  I recommend contacting Support if you are seeing blocks tied to the GTM installer.   ... View more

Hi @chetan85-   Sorry no one has gotten back to you in a more timely manner.  Yes it can.  Do you have specific questions? ... View more