topic Re: XDR & Java installs in Cortex XDR Discussions

XDR & Java installs

p.Dugan005079 — Mon, 27 Jan 2025 20:54:17 GMT

With the upcoming Oracle Java license changes, I'm looking into using XQL to report on existing installs, and potentially a process based BIOC to block new installs which would incur a licensing fee.

Anyone familiar with Java know how to differentiate between openJDK installs and OracleJDK installs?

Re: XDR & Java installs

aspatil — Tue, 28 Jan 2025 10:07:03 GMT

Hello @p.Dugan005079 ,

Thanks for reaching out on LiveCommunity!

You can start with preset = host_inventory_applications and filter with Application Name.

To block the installation, you can refer to below:

https://live.paloaltonetworks.com/t5/cortex-xdr-articles/cortex-xdr-poc-software-installations-blocking/ta-p/523556

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: XDR & Java installs

tlmarques — Tue, 28 Jan 2025 10:12:26 GMT

Hi,
For detect i used this query:

config case_sensitive = false timeframe=365d
| dataset = host_inventory
| filter applications != null
| arrayexpand applications
| alter applicationsName=json_extract(applications, "$.application_name")
| alter applicationsVersion=json_extract(applications, "$.version")
| filter applications contains "Java"
|fields applicationsName, applicationsVersion, ip_addresses, host_name

Re: XDR & Java installs

p.Dugan005079 — Tue, 28 Jan 2025 13:43:59 GMT

@aspatil @tlmarques
Thank you for input but niether of those replies are helpful. I am well aware of which datasets are available, how to use XQL, and how to block processes and installs with XDR.
The question is primarily about identifying which instances would incur a fee due to Oracle's upcoming licensing change - "Anyone familiar with Java know how to differentiate between openJDK installs and OracleJDK installs?"

Re: XDR & Java installs

aspatil — Wed, 29 Jan 2025 09:17:56 GMT

You can reach out to Oracle Team directly regarding your query. As being the Third Party Vendor we couldn't help identifying which instances would incur a fee due to Oracle's upcoming licensing change.