About dfalcon

Hi @joffrin.alexander-   After some checking, the limit for scripts is higher than 200 MB.  The PM I spoke to believes it is 500 MB.  ... View more

Hi @Marsooq-Akkaradathil-   You can view the results of the scan report in the Action Center.  Begin by going to Response > Action Center.    Within the All Actions list, locate your malware scan, right-click and select Additional Data.   If there were malicious files, they will show up here.  You can right-click and select View related alerts to see the malicious files and investigate deeper.      (Actual alerts below)     As far as the scan duration, I didn't see the full run time in the console.  You can, however, view this information from the agent by clicking on the scan tab.  I will check if a feature request has already been submitted for scan duration to be included from the console.  One more note on this -- the scans are not super fast by design.  The decision was made to allow the scans to run longer so that less system resources would be consumed.    Hope this helps.   ... View more

Hi @Mike_Hammonds -   Sorry, I haven't seen this before.  Can you please log a case at https://support.paloaltonetworks.com? ... View more

Hi @joffrin.alexander-   You are correct, the max file size is 200 MB.  (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/response-actions/initiate-a-live-terminal-session)   Please give me a day or so.  I will check with Product Management to see if they have any suggestions.   ... View more

Hi @lhatsadourian -   Are you still having this issue?  If so, are you seeing any error messages in the logs?  Also, can you log into the WildFire portal?  https://wildfire.paloaltonetworks.com ? ... View more

Hi @FaizalHasnol -   The release notes page details what is new and also has a section for known issues.  You can find the info at:  https://docs.paloaltonetworks.com/traps/4-2/traps-endpoint-security-manager-release-notes/release-information/features-introduced   If you look at the left hand menu, you can find the answers to your questions by browsing through each topic.      ... View more

Hi @DanielBenistiPel - Start off by going to settings and searching for the integration.  From there, you can configure the integration and show the commands that are available.      Also, you may get a faster response on XSOAR questions by posting to the Cortex XSOAR section.   ... View more

Your best bet is to use the WildFire portal to do a hash lookup.    https://wildfire.paloaltonetworks.com/wildfire/reportlist/Manual   Keep in mind, this only shows results for files known by WildFire.  If it is as unknown file, Local Analysis can still provide a verdict.  The only downside is, there is no way to know what scoring Local Analysis will give a file until the agent has a chance to see the actual file.  ... View more

Hi @timross-   I do not believe that such a page exists; however, the release notes document addresses both known issues as well as remediation of those known issues.    Known Issues:   https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-1/cortex-xdr-agent-release-notes/cortex-xdr-agent-release-information/known-issues-related-to-cortex-xdr-agent.html   Addressed:  https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-1/cortex-xdr-agent-release-notes/cortex-xdr-agent-release-information/cortex-xdr-agent-addressed-issues.html   Hope this helps. ... View more

Hi @Uriel_Reyes -   I have not seen this issue before.  The best course of action would be to gather a TSF (tech support file) from the endpoint, then reach out to Support (support.paloaltonetworks.com) so an engineer can dive deeper.  To get a TSF, locate an endpoint with the issue from your endpoint list, Right-Click > Endpoint Control > Retrieve Support File.   This will take a little while to run.  Once it is complete, download the file by going to the Action Center under the Response menu item.  Next, select All Actions, then locate the Support File Retrieval entry.  Right-click on that entry, then select Additional Data.   Now right-click on the entry and download the file.   Once you have the file in hand.  Log a support case and upload the file to the case.  This will speed up the investigation and resolution time. ... View more

Hi @amar.nath -   What type of alert is it?  Meaning, what is the source? ... View more

Hi @RichardChou -   Are you still having this issue?  Did you try to run the install with verbose logging to get a better idea of the root cause?   Example:  msiexec.exe /i YourCortexPkg.msi /L*V Install.log   If it fails again, you can then open the log and search for the error. ... View more

Hi @bartek -   Scheduled scans are not available in the Linux malware profile with the current version.  Where are you located?  It may be beneficial to set up a discussion with your local Cortex XDR account team - they can provide more info for you. ... View more

Hi @bartek -   I believe the shortest duration is weekly.  The scan is designed to look for dormant malware and the feature is there to satisfy audit requirements.  By design, the agent examines a file on execution.  It queries WildFire in real time (same feature you get in your scan) to look for a verdict.  For WildFire unknown files, it then executes local analysis, at the same time it uploads the file for execution.  Once uploaded, WildFire will perform Dynamic Analysis, and other interrogations if necessary, and will update the local verdict. ... View more

I haven't done QRadar yet, but I will ask around.  For now, do you have a preference on the log format?  Syslog, CEF, etc? ... View more

Hi @Marsooq-Akkaradathil -   I have not seen this issue.  To troubleshoot, have you tried modifying your agent profile to hide the agent icon.  Then, after checking in, modify the profile to show the icon again followed by one more check-in.  I'm just curious if this is a profile issue or agent issue.  ... View more