topic Re: Cortex XDR Pro - Vulnerability Assessment Replaced KBs in Cortex XDR Discussions

Cortex XDR Pro - Vulnerability Assessment Replaced KBs

Cyber1985 — Sun, 01 May 2022 18:19:35 GMT

Hey dear Cortex XDR Admins and Users,

when a KB was not installed in march and replaced with another KB from april like here:

https://administrator.de/forum/windows-server-2012-r2-windows-updates-2627286719.html

Is the best way to exclude the CVE in Cortex XDR?

Can Cortex XDR rearrange this by itself?

Rob

Re: Cortex XDR Pro - Vulnerability Assessment Replaced KBs

PMBTTSI — Tue, 03 May 2022 18:42:24 GMT

Same issue here.

Grabbing thousands of dollars for Hosts Insights and delivering an "vulnerability assesment" that it completly useless...

Re: Cortex XDR Pro - Vulnerability Assessment Replaced KBs

bbucao — Wed, 04 May 2022 03:38:46 GMT

Hi Cyber1985,

You can Exclude specific CVE's by navigating to Assets>Vulnerability Assessment>Vulnerability Assessment and clicking the "CVES" box in the top right. Then right click the CVE you want to exclude and click "Exclude", this will give you a prompt where you can also add a comment and/or report the CVE as incorrect.

Re: Cortex XDR Pro - Vulnerability Assessment Replaced KBs

PMBTTSI — Tue, 17 May 2022 20:23:04 GMT

This is completly useless. This is a major bug in the Vulnerabliitiy Assessments.

CVEs missing, where a newer KB was installed.

Very very bad Palo Alto Networks!

Re: Cortex XDR Pro - Vulnerability Assessment Replaced KBs

NathanBradley — Wed, 18 May 2022 18:31:14 GMT

Linux scans are even worse, backporting isnt taken into account.

Re: Cortex XDR Pro - Vulnerability Assessment Replaced KBs

Cyber1985 — Fri, 27 May 2022 22:24:47 GMT

Hey Bbucao,

will there be an improvement in the future? To click 100 times exclude CVE is not the daily business of mine and I would like to know if anybody works with the VA live?

Rob

Re: Cortex XDR Pro - Vulnerability Assessment Replaced KBs

Cyber1985 — Sun, 29 May 2022 21:43:47 GMT

Hello! Something happend in the background. Now none of our machines has CVEs. Is this a good sign?

Rob