API for exceptions?

Hi,
looking for API for adding exceptions, is it exists ?

I'd like to add programmatically exceptions which are done by UI > Settings > Exception Configuration > Legacy Agent Exceptions > Add Rule

Correct Way to Add Cortex Exclusions

Often, we get requests from application admins and their vendors to exclude an application or folder from the anti-virus or security software. In the past, we have entered these requests into the Allow List of the related Malware Profile (which has b

Cortex XDR | Azure AD Single Sign On Unauthorized. Unauthorized - 4010507

Hello all,

I am trying to setup SSO on my XDR tenant but I am getting the following message when login in
Unauthorized. Unauthorized - 4010507

In the console "Management Audit Logs" i see the below logs:

Custom Idp Saml User Invalid Error | invalid

Honeyuser with machine account name

How to create BIOC rule for AD machine account. Example if someone use net use command. so how to create alert for this use case ?

Push Cortex XDR datasets/logs to dedicated syslog server

Hi everyone,
I’m looking for some guidance on whether it’s possible to forward Cortex datasets to a dedicated syslog server for long‑term retention. Has anyone successfully done this, or is there a recommended method?
I’m also considering using Microso

High Bandwidth on Broker VM: Cluster Mismatch (v29 vs v28) & P2P

Hi everyone,

I'm facing high bandwidth usage on my Primary Broker VM. I need to validate if my diagnosis is correct:

The Setup:

• Cluster: HA Pair. Node 1 is v29.0.77 (Healthy). Node 2 is v28.0.99 (Service "Local Agent Settings" is Red/Down).

• Policy:

Cortex XDR installation on GKE AutoPilot cluster

Cortex XDR seems to support GKE AutoPilot in latest release 8.9.

However, when generating the Kubernetes manifests on Cortex XDR dashboard, they will not deploy on AutoPilot cluster. 

Instead, error message is given after kubectl apply command:
Vi

Local Analysis Malware and WildFire Malware Alerts

Can someone explain the Local Analysis Malware and WildFire Malware alerts. The WildFire alerts seem straightforward for a file that it deems malware. On the other hand, the local analysis malware alerts trigger for a bunch of files but in the alert

Pass-the-Ticket - PtT

Hi guys, 

Brew package manager for MacOS

We utilise Brew for package manager for our Mac in our organisation and we have over 100+ engineers using it to manage their operating environment. Cortex doesnt pick up any of the applications installed via brew or any of the vulnerabilities associa

XQL query to get a list of current applications installed on hosts