This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
About fmoixsante
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About fmoixsante
06-30-2022
57Posts
24Likes
13Solutions
Jun 30, 2022Last Visited
User
Activity
User
Profile
Latest posts by fmoixsante
| Subject | Views | Posted |
|---|---|---|
| 109 | 06-23-2022 02:08 AM | |
| 184 | 06-22-2022 02:14 AM | |
| 292 | 06-21-2022 09:24 AM | |
| 194 | 05-24-2022 07:30 AM | |
| 558 | 03-23-2022 03:09 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 03-23-2022 03:09 AM | |
| 2 Likes | 03-22-2022 03:44 AM | |
| 1 Like | 12-14-2021 04:04 AM | |
| 1 Like | 12-02-2021 01:48 PM | |
| 1 Like | 12-03-2021 07:57 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 2 Likes | |||
| 1 Like | |||
| 4 Likes |
User Badges
Community Statistics
| Member Since | 05-31-2017 02:47 AM |
| Date Last Visited | 06-30-2022 04:54 PM |
| Posts | 57 |
| Total Likes Received | 24 |
06-23-2022
02:08 AM
Hi @rtsedaka, Is Google Chrome Helper being blocked by XDR? if yes, which alert type? Local Analysis? Wildfire? Suspicious Process Creation?
... View more
06-22-2022
02:14 AM
Hi @Aiman_Fathima , It seems it is still not clear who the incident and alert process work in XDR. You do not resolve alerts, you resolve incidents. When you set the status of an incident "Resolved-xxx", you get the option to "resolve" the associated alerts. In the Alert table, you have the column " Resolution Status ". This column allows you to know if the alert was handled. The alerts will NOT disappeared. You can hide them by using filters, though. There are 2 ways to "resolve" alerts. One by resolving incidents, another by changing the resolution status directly on the alert. And remember that you need to work from the Incident view and not from the Alert table directly
... View more
06-21-2022
09:24 AM
Hi @Aiman_Fathima, Even though, you have the possibility to resolve alerts from the Alert table, you need to work on the Incidents and close those. If you are looking at the Alert Table, right-click on an Alert and go to Pivots to views > View related incidents. You can also add the column Incident ID to the Alert table. But remember that you need to work from the Incident view and not from the Alert table directly.
... View more
05-24-2022
07:30 AM
@pedrodias2020 If you are trying to uninstall on a Windows machine, I would suggest you also look at the XDR agent admin guide. In the uninstall section, it is explained how to use admin cmd and the msiexec method to uninstall the agent. Just remember that you need to have the same installation package version as the one installed locally for the method to work. You could also open a TAC case explaining the situation. It is quite odd that after you disable protections, the agent doesn't uninstall.
... View more
03-23-2022
03:09 AM
1 Kudo
Hi @JirapanMuencharern, This is the latest comment from our TAC support, "As part of our efforts to improve security PANW, an internal scanner generated a chain of events which caused our UI to have sporadic availability issues. The local agent protection as well as all analytics and detection capabilities were functioning throughout the issue."
... View more
03-22-2022
03:44 AM
2 Kudos
Hi @JirapanMuencharern This is something our PANW Devops and Engineering are looking into as we speak. Thank you for your post.
... View more
03-21-2022
06:20 AM
Hi @Grady I am taking note of this behavior and I will contact our internal teams to inquiry more about this discrepancy. I will post back here as soon as I have more information.
... View more
02-08-2022
02:10 AM
Hi @Grady Thanks for your question, for maximum reach and support, could you please re-post your query in English? Thanks in advance.
... View more
02-03-2022
05:55 AM
Hi @Daniel_Itenberg, What's the Malware module alerting about fixdep?
... View more
02-01-2022
01:59 AM
Hi @Daniel_Itenberg The Broker's proxy option does not affect the whole network connectivity of your endpoint. The Cortex XDR agent is the only application using the Broker's Proxy. Did you check the Windows Internet Option to see if there is anything configured there? In the malware profile, we have the Network Packet Inspection Engine, are you using this module? If yes, did you try to put it in Report mode? or even disabling it?
... View more
12-16-2021
11:21 PM
Another alternative is to use the Network Mapper applet from the BrokerVM. You do need Pro per endpoint or TB though.
... View more
12-16-2021
10:01 AM
Hi @tejasp04 , What do you see when you execute "./cytool proxy query"? Below, you can see how to query the proxy settings using ./cytool, setting a new proxy ipaddress:port and confirming that the settings are configured properly.
... View more
12-16-2021
01:43 AM
1 Kudo
The query I shared also gives all the files that Excel has opened. The query is just a basic query that you could use and modify as you like. For instance, dataset = xdr_data | filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN and actor_process_command_line contains "xlsm" I would suggest you check our XQL documentation here and here. I would also recommend you check our Cortex XDR Walkthrough videos. We have many videos showcasing every part of the Cortex XDR product.
... View more
12-15-2021
10:31 AM
1 Kudo
Hi @Kamal.Kishore, The XDR agent office protection ignores Excel files with no macros and will only report on those with a seemingly malicious macro. What you can do is look in XQL for all executed Excel files. You could try something like this dataset = xdr_data | filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN and actor_process_image_name = "EXCEL.EXE"
... View more
12-15-2021
09:56 AM
Hi @AsifSid The XDR agent will not uninstall itself for no reason. I would suggest you check your tenant. Also, the XDR agent, leaves log files in "c:\programdata\cyvera\logs\ "
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-30-2022
04:54 PM
|
Latest Tags
No tags yet
Likes From
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks