Allowing child process from parent process in Cortex XDR

Hello,

Is there a way to allow a legitimate parent process to create a legitimate child process on Cortex XDR that is being blocked due to "Suspicious Process Creation"? In my case, I whitelisted the child process but the block continues. I do not wa

Whitelist our backup software

Hello,
I do represent a company called Arx One. We have been publishing a backup software suite (backup agent, agent management console) for more than 15 years now and those software are installed on our customers' workstations, servers or NAS (Window

Cortex XDR Endpoint Protection Pre-Execution and Post-Execution Modules

Curious to know, of all the modules offered in Cortex XDR, exactly which ones are used during Pre-execution and Post-execution phases?

Long Malware Scan time, normal?

hello all experts, 

I have encountered a long scanning time,  i launched a malware scan from console to isolated endpoint, the job was created at 15:30 and finished by 05:30 by next day.

Guessing when the job was created, either the agent was dis

Failed to load license data

Since our recent renewal, which is reflected in Assets in the support portal, attempting to Cortex XDR results in an error message of "Failed to load license data or license is expired."

Background: We recently renewed our Cortex XDR Pro license. W

Best practice for installing agents on Windows "multi-session" Azure AVD?

Which method should be used to install the Cortex XDR agents for the Azure-only Windows 11 multi-session VDI? Since it's both a terminal server, and a non-persistent VDI that gets re-imaged from a golden image?

Suspicious domain suffix with a rare user agent - Explanation

Hello Community,

The BIOC Analytics has recently added these alerts and I wanted to get some insight and I hope this thread can be used in the future by others as well.

While the same seems straightforward there are some issues. The name of the aler

XQL Query - Union between Alerts and Incident datasets

Hi

I want to write an XQL query wherein i will be able to get both details of incident and Alerts in one table.

I want to correlate Incident ID and Description with the tables found in Alert dataset like CGO, Initiated by, Action process etc

XDR USB Activities

Hello, 

I have a few questions and I would be happy If you answer them. 

Questions:

1. In device control tab of Cortex XDR, I  can easily turn DIsk Drives to read mode. It is okey and working when I am doing this. I cannot delete any file, write or

XQL quey help

Hello everyone, 

I would like to replicate some queries in Cortex using XQL, but I have many doubts with this language and I am arguing with it 

Example:

T1140 Deobfuscate/Decode Files or Information 

Host insights enabled, yet only 12% have any CVE information. How to troubleshoot?

We've been running XDR Pro per endpoint since late 2022 with the host insights add-on licensed and enabled for all endpoints.
CVE data exists for around 12% of the endpoints and include every OS, etc... no rhyme or reason why some work, but most do no

How Cortex XDR alert/incident severity is decided or generated on tool

Hello all,

Please help me to understand how Cortex XDR assign the severity to incident and alert.

Failed to get unit file state for traps_spmd.service: No such file or directory

Hello,
I just installer a 8.2 XDR agent to a linux server
"/opt/traps/bin/cytool startup enable all" returns 

Process name Startup status
pmd Enabled
Failed to get unit file state for traps_spmd.service: No such file or directory
spmd Disabled
Failed to ge