Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Discussions

Sorted by:

Start a conversation

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

XDR Agent - retrieve more information events

Hi,

I have a question. I'm seeing XDR events with "Memory Corruption Exploit" generated by the XDR Agent... Cortex XDR

I know this typically happens when users open a DOCX file with macros. My question is: Is there a way to collect information rel

...

Resolved! [Mac & Linux ] Quarantined Files location

Hi, do you know the default location for the Quarantined Files location for Mac and Linux ?

i know the local quarantine folder for Win is (%PROGRAMDATA%\Cyvera\Quarantine ,but what about Mac and Linux ?

Cortex XDR

Broker VM - Local Agent Settings Applet Error

Hi Team,

As observed, we're getting the below error in the local agent settings applet in our broker vm's. We have three broker vm's in place and all of them are showing the same error. We have not made any changes in the configurations. Could you ple

...

Resolved! Linux Agent password protection

Hi,

i know that Linux Agent Tampering protection is not support yet , however what is the possible why to secure the agent?

Cortex XDR

Resolved! Cortex XDR folder taking up space

Hello Cortex Team,

On one of our server endpoint, the Dump folder located on the path : ProgramData\Cyvera\LocalSystem\Dump is taking a lot of space.

We already tried to clear the database of said agent, no difference. (see screenshot before and

...

Resolved! Connect New XDR Tenant with Existing Broker VM

Hello

We are migrating our existing XDR tenant due to region issue. We have got our new tenant and Basic configurations are done.
I have a question regarding the BrokerVM. Do we need to create new broker VM for the new tenant or we can use our existi

...

Resolved! File Integrity Monitoring FIM using Auditbeat module

Hello,

Looking to set up FIM using the Cortex XDR agent and from what I have found so far, it seems unsupported. Has anyone set up FIM using any method?

The only possible option I have found so far is maybe using an auditbeat with the FIM module:

...

Broker VM Log ingestion and forwarding

Hi,

My query is can we forward one broker VM logs to another broker VM.

Use case is I have BVM A and BVM 2,

1. I want to ingest logs into BVM A from Agents or other log sources.

2. Then forward logs from BVM A to BVM B.

3. BV

...

Unit 42 Palo Alto integration with SIEM particularly ?

How can we integrate Unit 42 Palo Alto with SIEM particularly Microsoft Sentinel?

Regards,

Shashank

Show results only with matching fields from two different queries

I am trying to combine the results from two queries, one using dataset=xdr_data and one from preset=xdr_file. But, I only want to see the results when the same "agent_hostname" appears in both queries. In other words IF agent_hostname from filtered x

...

Policies without certificate enforcement enabled warning message

Hi Team,

Recently I got a warning message in cortex saying that "Some of your endpoints have policies without Certificate Enforcement enabled". And by checking it further I could see that, this is to increase protection on the agent's communication

...

Resolved! Need help - BIOC / Script / XQL?

Hey everyone. I need some assistance in looking at this logically.

We have an identified PuP in our environment that is persistent. It creates a scheduled task and if you don't remove that, your PuP that you deleted will be back in no time.

Is th

...

Resolved! PowerShell Script Files when enabled showing as Risk

Hi ,

when enabling the PowerShell Script Files in the Malware profile , after the save it's showing as Risk with this profile!

can some explained the why ? and was it useful to enable PowerShell Script Files in the Malware profile ?

thank you

...

Interpreting alerts on XDR

Hi, The alerts on XDR and very much rigid and not readable even to the support personnel, whenever I raise a case they keep checking with other teams teams and higher support levels to get details, for example how to interpret the below, it says susp

...