Bitlocker events

KarlHalpin — Wed, 24 Aug 2022 11:31:18 GMT

Hi Everyone,

We are looking into using XDR to monitor bitlocker I know we can monitor if the volumes are encrypted or un-encrypted etc.

But is it possible for cortex to pick up pin changes from the endpoint events and if so does anybody know a good query for it?

would like to pick up people not changing their pin from the default.

Re: Bitlocker events

bbucao — Wed, 24 Aug 2022 14:30:05 GMT

Hi KarlHalpin,

Here is a list of the data collected by the agent, It does not look like any of these would include BitLocker events.

Regards,

Ben