About A_Adamski

Dear Palo Alto Community Members,   I hope you will be able to help me out or point me in the correct direction.   I'm struggling to find appropriate information about the operations for a cortex agent which will not be connected to the internet and will never be able to communicate with the cloud (Cortex XDR).  In my customer scenario, the machine is not and will never be connected to the internet. Therefore the agent will never be able to connect to Cortex XDR, not even during/right after installation.   While we could find a way to use the Content.zip which is available for download from the PA support portal alongside the installer itself, we are not sure about a way to export policies from Cortex XDR to feed them manually into the “offline” agent. We are also not sure about the license considerations, and the only piece of information I have found was informed that after 30 days when the endpoint has not communicated with Cortex Console we should see 'Connection Lost' notification. But I doubt it could actually be even something we will see in our scenario, as the agent will never communicate with the console. After some digging through the documentation we've come across information about the Cytool which might help to import/export the policies (for Windows and Linux machines). As I understand, in theory, I could import the policies from one agent and then export them to another one, is that correct? Unfortunately, I do not have any options to test it and I'm wondering if anyone had a chance to do it already, or maybe had some experience with a similar scenario and could share some thoughts?   I will really appreciate some help on this one.   Thank you in advance! ... View more

Dear PA community members,   I've done the research but could not find any info bout the Wildfire limitations nor any issues which could explain why in some cases the WildFire Report arrives with delays.   As per WildFire Analysis Concepts: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/endpoint-security-profiles/add-malware-security-profile/wildfire-analysis-concepts.html , *the only limitation mentioned in the documentation is: "Cortex XDR sends unknown samples for in-depth analysis to WildFire. WildFire accepts up to 1,000,000 sample uploads per day and up to 1,000,000 verdict queries per day from each Cortex XDR tenant. The daily limit resets at 23:59:00 UTC. Uploads that exceed the sample limit are queued for analysis after the limit resets. WildFire also limits sample sizes to 100MB. "   Based on the documentation WF should be able to deliver a verdict within 10-15 min after uploading the file (PE), which seems to be happening for most of the cases. Unfortunately but for some files, sent for Wildfire analysis after being Prevented (Blocked) on the XDR agent, the Cortex receives the verdict hours (sometimes days) later.   The thing is, as per my understanding the wildfire should be able to take just seconds to run the analysis and to generate the report, but for any reason, the Cortex has received it only the next day. Also, I know that as for the Next-Generation Firewalls the signatures will be updated and shared within the next Content Updates, but it's not what I will expect for Cortex / Taps.  *Am I missing something here, or it's something for the Palo Alto TAC to check?   As additional info, I've noticed that the recent files impacted by this issue have been first prevented (blocked), and on the next day WildFire changed the verdict from "Unknown" to "Benign".   Did anyone have similar issues in the past with WF? Could you please advise and point me in the correct documentation?   I will appreciate your help to understand this issue. Thank you in advance and kind regards. ... View more