Cortex Toolbox Kitlist Builder Ingest Calculator

Content ▾

Packs Integrations Playbooks Scripts

Incident Types Incident Fields Classifiers Layouts

Parsing Rules Correlation Rules Modeling Rules

Reputation Commands Threat Feeds

Docs ▾

Documentation Analytics Alerts XDM Explorer

Settings ▾

Show test playbooks Show deprecated content

Sign in

View as single page Filter topics

Learn about Cortex XSIAM
Onboard Cortex XSIAM
Configure Cortex XSIAM
Protect your endpoints
- Endpoint security
  - Endpoint protection
    
    Malware protection
    
    Exploit protection
    
    File analysis and protection flow
    
    Endpoint protection capabilities
    
    Endpoint protection modules
    
    Processes protected by exploit security policy
    
    File Integrity Monitoring (FIM)
    
    CaaS Workloads
    
    WildFire analysis concepts
    
    Guidelines for keeping Cortex XDR agents and content updated
    
    About content updates
    
    Endpoint data collection
  - Install and manage endpoints
    
    Set up endpoint protection
    
    Set up endpoint profiles and exception rules
    
    Set up malware prevention profiles
    
    Set up exploit prevention profiles
    
    Set up agent settings profiles
    
    Set up restrictions prevention profiles
    
    Set up exception profiles and rules
    
    Exception configuration
    
    Issue exclusions
    
    Add an issue exclusion rule
    
    Add an IOC or BIOC rule exception
    
    Add a disable prevention rule for endpoints
    
    Add a disable injection and prevention rule
    
    Add a support exception rule for endpoints
    
    Add a legacy exception rule for endpoints
    
    Add a new exceptions security profile
    
    Add a global endpoint policy exception
    
    Set up Identity profiles
    
    Define endpoint groups
    
    Configure global agent settings
    
    Apply profiles to endpoints
    
    Create an agent installation package
    
    Manage an agent installation package
    
    Harden endpoint security
    
    Device control
    
    Host firewall
    
    Host firewall for Windows
    
    Host firewall for macOS
    
    Disk encryption
    
    Host Inventory
    
    Vulnerability Assessment
    
    Set a Cortex XDR agent Critical Environment version
    
    Set an application proxy for Cortex XDR agents
    
    Manage endpoint protection
    
    Move agents between managing servers
    
    Manage endpoint tags
    
    Set an alias for an endpoint
    
    Manage endpoint prevention profiles
    
    Upgrade Cortex XDR agents
    
    Restart agent
    
    Uninstall the Cortex XDR agent
    
    Clear agent database
    
    Delete Cortex XDR agents
    
    Manage agent tokens
    
    Retrieve support file password
    
    Send push notifications to iOS
    
    Monitor agent operational status
    
    Monitor agent activity
    
    Monitor agent upgrade status
- Endpoint DLP
Detect, investigate, and respond to threats
Reference and developer docs

Reference and developer docs / Reference / Microsoft Windows security auditing setup

Microsoft Windows security auditing setup ↗

In Traps 6.1.3 and later releases, to enable Cortex XDR to collect Windows event logs, configure the following settings.

← Cloud service provider permissions Enable security auditing event IDs →

Cortex Toolbox v0.1.0 — a community tool, not an official Palo Alto Networks product. Estimates are indicative; validate sizing with your Palo Alto Networks representative.