topic Re: Disabled Capabilities of XDR on instaallation in Cortex XDR Discussions

Disabled Capabilities of XDR on instaallation

AbdBgc — Tue, 17 Sep 2024 07:32:33 GMT

Hi all,

in one of our customers with the installation of XDR agent version 8.5 the Response Capabilities (File Retrieval, Live Terminal, Script Execution) were disabled from the very beginning on many of the endpoints. As there is no other way, the agents were uninstalled and reinstalled as a solution. But we could not identify the main reason. Eventhough they did not change anything on the installation process they dont have the problem with the new installation now.

What could the reason be? Has anyone experienced sth similar?

Thanks in advance for your answers.

Re: Disabled Capabilities of XDR on instaallation

nsinghvirk — Tue, 17 Sep 2024 16:30:02 GMT

Hello @AbdBgc

Thanks for reaching out on LiveCommunity!

There are two ways to disable these XDR capabilities. One is by setting specific flags in msiexec command line during installation. Second is from XDR tenant, by going to specific endpoint in all endpoints then right click -> Endpoint control -> Disable capabilities.

If flags were not set during installation then someone must have disabled capabilities from XDR tenant. You can monitor this activity in management audit logs with type "Response" and sub type "disable capability".

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Disabled Capabilities of XDR on instaallation

AbdBgc — Thu, 19 Sep 2024 15:33:43 GMT

Hi @nsinghvirk ,

thanks for your reply. The ways to disable and monitor the capabilities are clear.

The problem is they were not disabled during or after the installation. "After" is confirmed once more over the Audit Logs. For "During" the customer says they have not disabled it during installation using any flags or so.

Thats why I asked if anyone else has experienced sth similar.