topic Re: CONTERX XDR Agent Brute-Force attack and NMAP scan detection. in Cortex XDR Discussions

CONTERX XDR Agent Brute-Force attack and NMAP scan detection.

M.Sorokins — Mon, 13 Jan 2025 15:53:11 GMT

Hello !

Is it possible with CORTEX XDR Agent installed on Windows/Linux Server to detect:

- ssh/rdp/ftp and WEB apps brute force attack.

-NMAP scans.

Thanks in advance,

BR,

Max

Re: CONTERX XDR Agent Brute-Force attack and NMAP scan detection.

neelrohit — Wed, 15 Jan 2025 16:40:39 GMT

Hi @M.Sorokins ,

Thank you for writing to live community!

While this forum is directed for cortex xdr related discussions, we do not have a specific capability endorsement or discussion that we generally cite. Cortex XDR definitely has UEBA based capabilities and network traffic detection capabilities based on telemetry collection. However, specific attack use cases require patterns and attack cycles which qualify as a MITRE ATT&CK lifecycle use case. I would highly recommend reviewing this analytics reference for detailed insights on detection rules and encourage testing the specific use cases for validation.

Hope this helps

Re: CONTERX XDR Agent Brute-Force attack and NMAP scan detection.

M.Sorokins — Thu, 16 Jan 2025 07:12:51 GMT

Thanks !

>>Cortex XDR definitely has UEBA based capabilities and network traffic detection capabilities based on telemetry collection.

Yes. It could be done via XQL queries with traffic and events patterns. It's not TRUE NIDS, but it it works.