XQL: How to find events from multiple host

Hi,

We need an XQL query that can identify events from multiple host that we define in the query.

Thank you.

Cortex XDR Agent Installation in Broker VM Base Linux OS

Hi Team,

We have Broker VM's in our environment, and they are hosted in the Esxi and are Linux Servers.

Do we need to install Cortex XDR Agent in the Base OS also?

PCSAE exam question

Hi.I thought answers  are A,B,D but some sources say it is BCD or ECD.I don't know which one is true.

In which three locations can an engineer try to find information, when troubleshooting a failed integration instance error produced by the test bu

PCSAE exam question

Which ones are true?I thought it is BD but some sources say it is CD

Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)

• A. Use a field of Number to count the number of seconds elapse

Ingest AWS GuardDuty logs

Dear community,

I'm seeking help to ingest AWS Guardduty logs into Cortex XDR.

I did check the documentation and only found the method to ingest AWS assets, Flow log via S3 and Route53 via S3. 
I don't mind the AWS guardduty logs is not normalized,

cortex broker log collector in HA Active Pasive

Good morning, dear friends,

I am facing the challenge of installing 2 broker VMs in HA (Active - Passive) as Log Collectors to receive logs from different data sources. My biggest concern and doubt is the configuration of the HA architecture of the

XSIAM Assets / Network Mapper - How to identify unknown assets

We configured network mapper in the BrokerVM settings and using multiple ports for network identification. Of course, on the firewalls we allow all traffic from them to make a full visibility internally. However, the scan doesn't resolve the hostname

Forwarding event to XSIAM

hi , how can i forward special event id to xsiam . For example i want to send 4624 id event log from active directory to cortex xsiam

Custom logo in XSIAM

Do we have an option to change/add the custom logo in XSIAM UI

XQL Query for a Correlation Rules

I am trying to write a xql query for a correlation rule in which alert or incident will trigger for below condition.
Condition:

Threshold: Only once on match 2

Detect on unique values of: hostname

So, my question is. how to write "Detect on unique valu

Agent update failed

3 computers failed to update the agent,current version 8.4.1.53273 and target version is 8.5.0.624. PC1 Additional Date：Windows Installer DB: Extra reference(s) to agent component(s); PC2 Additional Date：Windows Installer DB: Current agent registr...

Cortex xdr Linux agent Virtual Installation

Hi Team,

We have a query regarding the installation of the Cortex XDR Linux agent on the Virtual machine. We followed the steps mentioned in the document https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.4/Cortex-XDR-Agent-Administrator-Guide

Configuring alerts in Cortex XDR to prevent incident generation

Hello,

I want to configure certain NGFW alerts in Cortex XDR so that they no longer generate incidents based on criteria such as the alert name, source zone, and destination zone. I do not want to completely hide the alert with an "Alert Exclusion"