Home
EN
Location
Documentation Home
Palo Alto Networks
Support
Live Community
Knowledge Base
MENU
Home
Security Operations
Cortex XDR
Cortex® XDR Pro Administrator’s Guide
Investigation and Response
Investigate Endpoints
Document:
Cortex® XDR Pro Administrator’s Guide
Investigate Endpoints
Download PDF
Last Updated:
Tue Jun 28 06:51:20 PDT 2022
Table of Contents
Search the Table of Contents
copyright
Cortex XDR Overview
Cortex XDR Architecture
Cortex XDR Concepts
Cortex XDR Licenses
Features by Cortex XDR License Type
Cortex XDR Endpoint Agent License Allocation
Cortex XDR License Expiration
Cortex XDR License Monitoring
Migrate Your Cortex XDR License
Get Started with Cortex XDR Pro
Setup Overview
Plan Your Cortex XDR Deployment
Deploy your Network Devices
Activate Cortex XDR
Manage User Roles
Permission Management
Access Management
Manage Users
Manage Roles
Manage User Groups
Predefined User Roles for Cortex XDR
XDR Account Admin
Instance Administrator
Deployment Admin
Investigator
Investigation Admin
Responder
Privileged Investigator
Privileged Responder
IT Admin
Privileged IT Admin
Privileged Security Admin
Viewer
Scoped Endpoint Admin
Security Admin
Manage User Scope
Set Up Cloud Identity Engine
Manage Your Log Storage within Cortex XDR
Set up Endpoint Protection
Plan Your Agent Deployment
Enable Access to Cortex XDR
Resources Required to Enable Access to Cortex XDR
Proxy Communication
Configure Your Network Devices
Set up Network Analysis
Configure Cortex XDR
Integrate External Threat Intelligence Services
Set up Your Cortex Environment
Set up Outbound Integration
Use the Interface
Manage Tables
Endpoint Security
Endpoint Security Concepts
Cortex XDR versus Traditional Endpoint Protection
File Analysis and Protection Flow
Endpoint Protection Capabilities
Endpoint Protection Modules
Manage Cortex XDR Agents
Create an Agent Installation Package
Set an Application Proxy for Cortex XDR Agents
Move Cortex XDR Agents Between Managing XDR Servers
Upgrade Cortex XDR Agents
Set aCortex XDR Agent Critical Environment Version
Delete Cortex XDR Agents
Uninstall the Cortex XDR Agent
Set an Alias for an Endpoint
Manage Endpoint Tags
Manage Agent Tokens
Define Endpoint Groups
About Content Updates
Endpoint Security Profiles
Add a New Exploit Security Profile
Processes Protected by Exploit Security Policy
Add a New Malware Security Profile
WildFire® Analysis Concepts
Add a New Restrictions Security Profile
Manage Endpoint Security Profiles
Customizable Agent Settings
Add a New Agent Settings Profile
Configure Global Agent Settings
Endpoint Data Collected by Cortex XDREndpoint Data Collection
Apply Security Profiles to Endpoints
Exceptions Security Profiles
Add a New Exceptions Security Profile
Add a Global Endpoint Policy Exception
Hardened Endpoint Security
Device Control
Host Firewall
Host Firewall for Windows
Host Firewall for macOS
Disk Encryption
Host Inventory
Vulnerability Assessment
Investigation and Response
Cortex XDR Rules
Working with BIOCs
BIOC Rule Details
Create a BIOC Rule
Manage Global BIOC Rules
Working with IOCs
IOC Rule Details
Create an IOC Rule
Working with Correlation Rules
Correlation Rule Details
Create a Correlation Rule
Manage Existing Indicators
Search Queries
Cortex XDR Query Builder
XQL Search
Create an XQL Query
Translate to XQL
Manage Your Personal Query Library
Visualize Query Results
Create a File Query
Create a Process Query
Create a Network Query
Create an Image Load Query
Create a Registry Query
Create an Event Log Query
Create a Network Connections Query
Create an Authentication Query
Query Across All Entities
Query Center
Manage Your Queries
Quick Launcher
Scheduled Queries
Manage Scheduled Queries
Research a Known Threat
Investigate Incidents
Incidents
External Integrations
Manage Incident Starring
Create an Incident Scoring Rule
Triage Incidents
Manage Incidents
Investigate Artifacts and Assets
Investigate an IP Address
Investigate an Asset
Investigate a File and Process Hash
Investigate a User
Investigate Alerts
Alerts
Triage Alerts
Manage Alerts
Alert Exclusions
Add an Alert Exclusion Policy
Causality View
Network Causality View
Cloud Causality View
Timeline View
Analytics Alert View
Investigate Endpoints
Action Center
Manage Endpoint Actions
View Details About an Endpoint
Retrieve Files from an Endpoint
Retrieve Support Logs from an Endpoint
Scan an Endpoint for Malware
Investigate Files
Manage File Execution
Manage Quarantined Files
Review WildFire® Analysis Details
Import File Hash Exceptions
Forensic Data Analysis
Forensics Add-on Options
Response Actions
Initiate a Live Terminal Session
Isolate an Endpoint
Pause Endpoint Protection
Remediate Changes from Malicious Activity
Run Scripts on an Endpoint
Search and Destroy Malicious Files
Manage External Dynamic Lists
Broker VM
