topic Some Cortex XDR events are not displayed in the endpoint client's events tab in Cortex XDR Discussions

Some Cortex XDR events are not displayed in the endpoint client's events tab

Isuru — Mon, 19 Jun 2023 13:37:07 GMT

Hi,

We recently onboarded Cortex XDR and some of the detections are not displayed in the Cortex client's Events tab. But I can see them in the Cortex XDR console.

As an example I can see Prevented (Blocked) malware in both cloud console and the endpoint's events. But Detected (Scanned) type alerts can only be seen in the cloud console and there are no events in the Endpoint logs. Is there some types of detections that displays in the endpoint?

Thanks,

Isuru

Re: Some Cortex XDR events are not displayed in the endpoint client's events tab

neelrohit — Mon, 19 Jun 2023 15:13:01 GMT

Hi @Isuru ,

Thank you for writing to live community!

The cortex XDR prevention and detection events are listed as per our fundamental design of our product. ie, execution based detection. Whenever there is an execution based detection event, XDR will list those events out in the agent console under the Events section(these also get purged out after some time). The example screenshot is listed below.

However, if you see, there is also another tab for scan which shows the scan results and malicious files detected as part of the malware scan will be listed in this section and will vanish later. These events are the ones which are listed as Detected(Scanned) in Cortex XDR. Screenshot below.

Hope this helps. Please mark the response as "Accept as Solution" if it answers your question

Regards

Re: Some Cortex XDR events are not displayed in the endpoint client's events tab

Isuru — Tue, 20 Jun 2023 13:34:49 GMT

Hi, thanks for the reply. However I cannot see those detections in the scans section. Is there a configuration change related to this in the Cortex admin console?

Re: Some Cortex XDR events are not displayed in the endpoint client's events tab

neelrohit — Tue, 20 Jun 2023 14:03:09 GMT

Hi Isuru,

The scans section shows it only temporarily and as I mentioned in the previous response, it is removed after some time and the data is available on the console in form of alerts and incidents.

Hope this helps