Simulating "Respond to Malicious Causality Chain" feature

OnurOnoglu — Sat, 29 Jul 2023 08:25:08 GMT

Hello there,

As the title suggests, we are looking for a test we can simulate the behavior (have kali / attacker / victim test environment).

Any suggestions?

Thanks

Re: Simulating "Respond to Malicious Causality Chain" feature

nsinghvirk — Tue, 01 Aug 2023 10:56:39 GMT

Hello @OnurOnoglu

Thanks for reaching out to us!

With "Respond to malicious casualty chain" feature enabled Cortex XDR agent identifies a remote network connection that attempts to perform malicious activity—such as encrypting endpoint files. The agent then can automatically block the IP address to close all existing communication and block new connections from this IP address to the endpoint. When Cortex XDR blocks an IP address per endpoint, that address remains blocked throughout all agent profiles and policies, including any host-firewall policy rules. You can view the list of all blocked IP addresses per endpoint from the Action Center, as well as unblock them to re-enable communication as appropriate.

Unfortunately we cannot share any such script or test to simulate such behaviour because this involves a remote host to simulate attack which go through your network and may create other problems for you.

topic Simulating "Respond to Malicious Causality Chain" feature in Cortex XDR Discussions

Simulating "Respond to Malicious Causality Chain" feature

Re: Simulating "Respond to Malicious Causality Chain" feature