https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/file-reads-not-returned/m-p/426571#M961 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/150738">@BenHooper</a>,</P><P>&nbsp;</P><P><A href="https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/customizable-agent-settings/endpoint-data-collected-by-cortex-xdr.html" target="_self">File reads are certainly supported.</A> Did you confirm if EDR was enabled on your endpoint? Are you still observing this issue?&nbsp;<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="gjenkins_0-1628787859625.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/35668i767969323565D243/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="gjenkins_0-1628787859625.png" alt="gjenkins_0-1628787859625.png" /></span></P><P>&nbsp;</P> Thu, 12 Aug 2021 17:04:40 GMT gjenkins 2021-08-12T17:04:40Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/file-reads-not-returned/m-p/351154#M333 <P>The file event search is supposed to support reads but I've never seen it work.</P><P>&nbsp;</P><P>Is this a known problem?</P><P>&nbsp;</P><P>Examples:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2020 ∕ 09 ∕ 22 16꞉42꞉38 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/27846iD71B316E275B9022/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="2020 ∕ 09 ∕ 22 16꞉42꞉38 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png" alt="2020 ∕ 09 ∕ 22 16꞉42꞉38 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2020 ∕ 09 ∕ 22 16꞉43꞉29 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/27847i55E22046763CE750/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="2020 ∕ 09 ∕ 22 16꞉43꞉29 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png" alt="2020 ∕ 09 ∕ 22 16꞉43꞉29 - Query_Results_-_Cortex_XDR_-_Google_Chrome.png" /></span></P> Tue, 22 Sep 2020 15:45:03 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/file-reads-not-returned/m-p/351154#M333 BenHooper 2020-09-22T15:45:03Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/file-reads-not-returned/m-p/426571#M961 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/150738">@BenHooper</a>,</P><P>&nbsp;</P><P><A href="https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/customizable-agent-settings/endpoint-data-collected-by-cortex-xdr.html" target="_self">File reads are certainly supported.</A> Did you confirm if EDR was enabled on your endpoint? Are you still observing this issue?&nbsp;<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="gjenkins_0-1628787859625.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/35668i767969323565D243/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="gjenkins_0-1628787859625.png" alt="gjenkins_0-1628787859625.png" /></span></P><P>&nbsp;</P> Thu, 12 Aug 2021 17:04:40 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/file-reads-not-returned/m-p/426571#M961 gjenkins 2021-08-12T17:04:40Z