topic Cortex XDR PRO - Exploit Profile Question in Cortex XDR Discussions

Cortex XDR PRO - Exploit Profile Question

RFeyertag — Thu, 25 Apr 2024 19:34:14 GMT

Hello dear comminity,

is there any log to see, filter or get notified, if the agent makes changes in the configuration?

Rob

Re: Cortex XDR PRO - Exploit Profile Question

jmazzeo — Thu, 25 Apr 2024 20:18:38 GMT

Hi @RFeyertag, thanks for reaching us using the Live Community.

That feature only applies on those specific CVEs: CVE-2021-24074, CVE-2021-24086, and CVE-2021-24094 for unpatched systems.

You can see more details about this setting in the Add a New Exploit Security Profile document page.

In this same page you can also see which commands are executed on the endpoints (item 4) to patch this vulnerabilities, those can be used to run a XQL query and find on which endpoints it was applied.

If this post answers your question, please mark it as the solution.

Re: Cortex XDR PRO - Exploit Profile Question

RFeyertag — Thu, 25 Apr 2024 20:45:20 GMT

@jmazzeo Thank you! I thought this would be a general vulnerability setting changer.

Rob