About dfalcon

First, what type of license to you own?  Prevent, Pro for Endpoint, and/or Pro per TB?   Second, when you look at the number of agents in endpoint administration interface, what is the count?  There is also an agent dashboard that can be helpful here.     ... View more

The actual account must be created in the CSP.  Go to support.paloaltonetworks.com and within the Users menu on the left, create the user there.  A limited account is all that is needed.  Once created in the CSP, you can go to the Hub and assign the appropriate role there.  ... View more

Hi @KRisselada-   From the alert, what is listed as the source? ... View more

Hi @asiddiquie-   I have not heard of any reports.  Are you experiencing any issues? ... View more

Hi @CyberEye -   From one of the workstations, what do you see during the upgrade attempt?  Is the package getting there?  Is there an error?  Or is it failing without any notification.  Have you tried running the installer directly from a workstation?   As far as the upgrade goes from SCCM, I would actually use a standalone installer.  I believe the upgrade .zip contains multiple installers.  ... View more

Hi @thejackal -   Have you submitted an incorrect verdict submission for this?  You can do this from the WildFire interface in the incident. ... View more

Hi there,   The problem may be the Linux machine itself.  Kali is ran on a CentOS workstation.  The Cortex XDR Linux agent is only supported on Linux servers.  What OS flavor are you using?   Second question, what types of machines will be leveraging the broker? ... View more

Hi there-   The quarantine function is limited to PE's and DLL's and can be set in the malware profile.   Macros are different in that you would not want to quarantine the actual executable, which would be Word, Excel, etc.   For that reason, the specific file is what is terminated, while the Office application remains open.  Your option for a macro is simply to block.   BTP is also different.  When events occur on the endpoint, they are loaded into BTP memory.  From there, the event is compared to a list of built-in BTP rules and if one is triggered, it is terminated.  This cycle is repeated based on what is occurring.  For example, someone may be running Outlook.  That person receives and opens an email, then opens a Word attachment.  After the Word attachment is open, a macro is executed which is doing something it shouldn't.  BTP looks at each stage in this process and terminates once something matches a built-in BTP rule.  You cannot check BTP at rest since it is based on behavior in motion. ... View more

I've never heard of a blank password.  You are prompted to set an uninstall password during initial configuration.  There is a default password in the event you never establish connectivity that may be helpful.   Check step 2 in this link:  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/customizable-agent-settings/global-agent-configurations.html ... View more

The supervisor password is actually the uninstall password that is defined within your agent profile.  If you do not know the password, please reach out to Support.  They can assist you with removing the agent.   ... View more

Hi @Edmund66-   Please let me know if your approach does not work at which time I'd like to gather a little more info to take to Product Management. ... View more