topic Vuln drivers - scan in Cortex XDR Discussions

Vuln drivers - scan

tlmarques — Fri, 22 Nov 2024 12:30:02 GMT

Hi,

Anyone know if is possible to retrieve the devices with drivers with vulnerabilities?
I've a lot devices with and my objective is force IT guys, update vulnerable drivers etc.

Re: Vuln drivers - scan

nar — Tue, 26 Nov 2024 07:38:53 GMT

Hi @tlmarques

Thanks for your query on LC!

XDR offers built in rules which basically detects and reports vulnerable drivers so one way I could think of is building an XQL to filter the hosts that have these "Vulnerable driver loaded" alerts and we can also run a query to list all the unsigned drivers to investigate on.

Give a like or mark as solution if this suggestion helped.

Best,
Naveen

Re: Vuln drivers - scan

tlmarques — Tue, 26 Nov 2024 18:56:32 GMT

@nar thnks, i know that, my problem is, it dont see the filter in XQL for "description"