topic Re: initial profiling? in Cortex XDR Discussions

initial profiling?

TonyTovar — Tue, 21 Jul 2020 23:23:50 GMT

when you first install the Cortex XDR agent on a new server (and reboot if on Windows), is it immediately 'active' and blocking suspicious processes? I was told that it ran in 'passive' mode for 30-days as it built a profile of "normal" activity for that agent. I ask because we are starting to use immutable servers which are recreated from-scratch on a regular basis.

Re: initial profiling?

dfalcon — Wed, 22 Jul 2020 00:24:17 GMT

Hi there-

For malware, exploits, and most threats - those are blocked immediately based on your malware / exploit profile settings under the endpoint management section.

The profiling you are referencing refers to the analytics component. That feature is essentially learning the behavior of the environment based on the computer and user entity. It is learning who is supposed to be doing what — it raises an alert when suspicious behavior is detected based on the behavior not matching that entity. The profiling ranges anywhere from a few days to 4 weeks based on the collector type.

Re: initial profiling?

TonyTovar — Fri, 14 Aug 2020 20:48:46 GMT

Thanks, David! So, in general, the agent is 'active' and protected the server immediately -- but with some delay for the "analytics" portion?

Also, I have now learned that there are 3 Cortex XDR licenses and we probably have just the base license (not "Pro"). So we are not getting EUBA or Network-Traffic Analytics. Was one of those the 'analytics' module to which you were referring? Or, is there also such a module in the base license?

Re: initial profiling?

dfalcon — Mon, 17 Aug 2020 17:20:19 GMT

HI @TonyTovar ,

Yes, that is correct. If you are using Prevent, the profiling component is not part of that offering. You have all included protections available immediately.

Re: initial profiling?

TonyTovar — Mon, 17 Aug 2020 17:27:16 GMT

Is 'Prevent' the base-level license?

Re: initial profiling?

dfalcon — Mon, 17 Aug 2020 18:40:01 GMT

Hi @TonyTovar,

Yes. Prevent protects from malware, exploits, advanced threats. It does not include the analytics and some of the other EDR features.