topic Re: Agent script Library in Cortex XDR Discussions

Agent script Library

NivedaR — Wed, 15 Mar 2023 14:15:31 GMT

Hello,

I would like to know if a script to that invokes live terminal or other functions related to Cortex XDR can be done using agent script library.

Re: Agent script Library

anlynch — Wed, 15 Mar 2023 21:38:17 GMT

Hi @NivedaR ,

Thanks for reaching out on LIVEcommunity.

If I understand your question correctly you're asking if there's a script that can be run on and endpoint to invoke live terminal in the Cortex XDR Tenant. As it stands right now there is no script available to accomplish this task. Live terminal is instantiated from the Cortex XDR Tenant only. It can't be instantiated locally on an endpoint.

If I didn't get your question right please clarify and include the use case. I'll be happy to help.

Have a great day!

Re: Agent script Library

NivedaR — Mon, 20 Mar 2023 10:09:02 GMT

Hello ,

Thanks for the answer. I am wondering currently there is an automate feature in XDR that came with the cortex 3.6 . On it there is an option to run script on a specific alert . I was wondering if we could use that automation to open live terminal on the endpoint if a specific alert arises.

Re: Agent script Library

anlynch — Mon, 20 Mar 2023 20:23:42 GMT

Hi @NivedaR,

The automation feature in 3.6 and Live Terminal are 2 separate features. Live Terminal is an action that can only be done in the Cortex XDR Tenant. There is no need for a script to run Live Terminal. Here are 2 ways you can access Live Terminal.

1. Incident Response -> Live Terminal

2. Endpoints -> All Endpoints -> right click on the desired endpoint -> Security Operations -> Initiate Live Terminal

I hope this informations helps answer your question. Please let me know if you need anything else.

Re: Agent script Library

NivedaR — Mon, 20 Mar 2023 15:38:41 GMT

Hello,

Thank you.