Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XDR Discussions
Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.
About Cortex XDR Discussions

Cortex XDR allows you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view ALL the alerts from all PANW products in one place, telling the full story of what actually happened in seconds and allows seamless response.

Please note: All postings in LIVEcommunity are visible to other users; please keep your network secure by refraining from posting live IP address’s or domain names here. Contact your Customer Success team for network-specific questions.

Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

 

Rules and Best Practices

 

  1. Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion
...

JayGolf by Community Team Member
  • 1061 Views
  • 0 replies
  • 2 Likes

Cortex XDR login issue

Hi everyone,

 

I can't sign in to Cortex XDR Console for about 10 minutes. I receiving "Unauthorized - 4010402" for 3 different users. Is it general problem or only for my tenant? I have also another tenant and it works normally. Could you help me?

...

123.png

Resolved! Can't find references from training video

In the "Cortex XDR Basic XQL Crash Course" found here LIVEcommunity - Cortex XDR How-to Videos - LIVEcommunity, they reference two reference documents. I have searched everywhere I can think to search but I find nothing. Does anyone know where I can

...

XDR version 3.x vs 4.x

Hello Experts,

I noticed there's two versions of XDR 3.x and 4.x, Mine is running 3.x. noticed that's quite lot of changes (in UI) for 4.x.
1) will my XDR  be upgraded to 4.x eventually?

2) when?

3) what is the purpse of running both version?

4) is 4.

...

Resolved! BTD - PROCEXP152.SYS - Vulnerable Driver Loaded

Cortex blocked driver PROCEXP152.SYS from being loaded (rule: sync.vulnerable_driver_by_original_name_loaded_procexp)
The thing it that this is a signed microsoft driver and it's kind of a known situation for many other vendors.

Links: Process Explorer

...

Panagiss by L1 Bithead
  • 12139 Views
  • 3 replies
  • 0 Likes

error when try to install cortex on redhat 10

Hello,

 

I try to install Redhat 10. i downloaded last version of packages.

When i try to install on rehdta, i have this error :

 

 

./cortex-8.8.0.133595.sh
Verifying archive integrity... All good.
Uncompressing Cortex XDR 8.8.0.133595 installer 100%
[!

...

action_process_image_command_line Filter Issue

Hi, I'm trying to build a query that would check for reg.exe launches. This is well and good, but the moment I add a filter action_process_image_command_line = "reg save" nothing appears, even though it was part of the initial result for reg.exe. Whe

...

unfiltered.jpg
filtered.jpg
a2123k1 by L1 Bithead
  • 289 Views
  • 2 replies
  • 0 Likes

Resolved! Cortex false positives for OneDriveLauncher.exe?

For the last few days I've had random machines (some with fresh Windows installs) triggering Cortex alerts when logging into OneDrive.

The alert is Behavioral threat detected (rule: parent_process_spoofing) and the path is the legitimate OneDrive exe

...

JGrover1 by L0 Member
  • 2186 Views
  • 7 replies
  • 1 Likes

Resolved! Broker VM ssl connection

Hi.

I have configured a proxy for the Broker VM on the endpoints. The Cortex XDR agents on these endpoints are establishing SSL connections to the Broker VM over port 443.

Should the agents on the endpoints establish an SSL connection to the Broker V

...

Aristooo by L2 Linker
  • 459 Views
  • 2 replies
  • 0 Likes
  • 2351 Posts
  • 87 Subscriptions
Top Solution Authors
Top Liked Authors