About PeteJacobCF

@eluis thanks for the reply back man! I was just thinking that if its an available option now for windows if it would be good to enable it... I have read up on what it is but don't really understand fully what it is and what it does. I think for now I will just work on the "OpenSSL Infinite Loop Vulnerability" and put this on the back burner.   ... View more

hello I am very interested in doing this. not too sure what the "cortex dhcp log collector"? I will look it up, also can you do this with the prevent subscription? vs the pro subscription?  ... View more

looks like v5.2.10 is officially supported on win11 https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304 ... View more

I would say if its not on this list its not supported. have you talked to your cortex se about it? https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/where-can-i-install-the-cortex-xdr-agent.html ... View more

what version and content release is your asset on? ... View more

you could get the cleaner from support. or you could create a profile that disables the anti tampering and push that to that asset. ... View more

hello @KRisselada yeah I am running just XDR prevent not pro and it can be a chore for sure. I basically have to monitor for the email content release and then check my console and sort by content version. I have talked to support a few times and my SE. The only real fixes are remove the agent and re-install specifying that content release during install (this is not always ideal). or download a support file from the console and sort thru it... the reasons why can be quite a few but some are low diskspace. I wished that you could force a content update and get a better answer without having to spend a ton of time. Basically support tells you to "just wait" it will come when it comes, or check hard drive space.   keeping up to date with content releases is really very important and overlooked imo  ... View more

honestly if your up to date on patches for 2008r2 sp1 and are still getting that error I would run the cleaner reboot and then install that version. ... View more

it looks like  Azure Virtual Desktop (WVD or AVD) is supported with v7.5 or v7.6 https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/where-can-i-install-the-cortex-xdr-agent.html ... View more

I would think that you should at least be able to look at your "assigned prevention policy" and ensure that the "malware" profile assigned to all assets has scans enabled.   does this make sense?  ... View more

looks like in the new v3.1 version you can do this: Permanently Delete Quarantined files ( Requires a Cortex XDR agent 7.6 or a later release for Windows ) To help you better manage malicious files which have been quarantined and avoid any potential mistake of restoring unwanted files, you can now permanently delete quarantined files on the endpoint from the File Quarantine Details page. ... View more

sounds like you need to run the agent cleaner on the asset first, then reboot and you should be good to go.  ... View more

I see that as well on a handful of assets as well. I spoke to the tac on this and they basically said to either un-install or run the cleaner. you can also try to use cytool to disable   cytool protect disable process cytool protect disable  Registry cytool protect disable file cytool protect disable service   https://docs.paloaltonetworks.com/cortex/cortex-xdr/5-0/cortex-xdr-agent-admin/traps-agent-for-windows/troubleshoot-traps-for-windows/cytool.html   Having said that I always see this on a handful of assets, and find it is just quicker to either uninstall the old version then re-install. would be nice to know why this is happening.  ... View more