The Cortex XDR not installed still incident getting generated

Shinde_Dipak — Fri, 24 Nov 2023 14:54:08 GMT

We have observed incident on the server in which Cortex XDR is not installed. The system is only present in the asset inventory. How is this possible, on what basis incident is getting generated?

Incident Name: Multiple Rare LOLBIN Process Executions by User

Thanks in advance.

Re: The Cortex XDR not installed still incident getting generated

jtalton — Mon, 27 Nov 2023 21:40:56 GMT

Hello Shinde_Dipak,

'Multiple Rare LOLBIN Process Executions by User' alert is generated by XDR Analytics were detected. Reference Multiple Rare LOLBIN Process Executions by User • Cortex XDR Analytics Alert Reference

The source for this detection is data collected from the XDR Agent with Identity Analytics enabled. However, customers can take advantage of analytics network or identity detectors on a host in the absence of the XDR agent if additional network and identity data sources (Cloud Identity Engine, Azure etc.) are onboarded directly into Cortex XDR.

For example, in addition to the agent, Cortex XDR can ingest PAN NGFW Enhanced application logs (EAL) and Third-party authentication service logs with the Pro GB or Cloud license to detect threats by collecting and analyzing cloud logs. Its analytics detectors examine cloud audit, flow, and identity logs to baseline behavior.

Reference

Ingest Data from Next-Generation Firewall • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

Visibility of Logs and Alerts from External Sources • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

Analytics • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

To investigate, concerning the endpoint data collection gathered to stitch an alert, review the Debug alert data collected from the event for analysis:

Collect Debug data from Incidents Tab

Go To Incidents Tab and select the Incident that you want to Debug.
Alt+ Right Click on the Incident and select Download Debug Data

Collect Debug Alert data From Alerts page

Go to the Alert and press Alt+ Right Click to select Debug Alert

It will open another window with Debug logs. Click on 'Copy Log' and view the logs for analysis.

If you found this answer helpful, please select Accept as Solution.

Thank you!

topic The Cortex XDR not installed still incident getting generated in Cortex XDR Discussions

The Cortex XDR not installed still incident getting generated

Re: The Cortex XDR not installed still incident getting generated