topic Re: Cortex XDR Forensics doesn't display Endpoints in Cortex XDR Discussions

Cortex XDR Forensics doesn't display Endpoints

Aristooo — Thu, 22 Aug 2024 12:59:50 GMT

When I configure Forensics, at the 'Endpoints' step, it doesn't show the name of any endpoint. "Monitor and Collect Forensics Data" is enabled on Agent Settings. User role is Instance Administrator. Triage type is "Online".

Re: Cortex XDR Forensics doesn't display Endpoints

nsinghvirk — Thu, 22 Aug 2024 16:29:07 GMT

Hello @Aristooo

Thanks for reaching out on LiveCommunity!

On the configuration page, depending on the type of Artifacts, Volatiles and File collection you choose there may be different minimum agent versions requires to perform triage. Hence on the endpoints page please hover your mouse over "Eligible for forensics triage" button to see the conditions required for the eligible endpoints as shown in attached screenshot.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Cortex XDR Forensics doesn't display Endpoints

Aristooo — Fri, 23 Aug 2024 06:17:55 GMT

Hello @nsinghvirk
Thank you for your response. The endpoint meets all the requirements. And Forensics is enabled. I have activated 'Forensics' in the agent settings. Could it be that it needs to be activated somewhere else as well? Are 'Forensics' and 'is forensics' different things?
I have added screenshots

Re: Cortex XDR Forensics doesn't display Endpoints

Aristooo — Thu, 29 Aug 2024 05:34:04 GMT

Solved!
I had not added the profile for Forensics to the "Prevention Policy Rule.