Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
Hi Guys,
Sort of new to XDR does anyone have any good xql queries for detecting assets without cortex agents installed and if the cyserver service has stopped working?
Thanks
Hi everyone,
Can we get the notification on Cortex XDR Management console, if any user is trying to disable the XDR Agent protection and services ?
Regards
Hi Folks,
With Cortex XDR can we use feature like System lockdown, more likely say that execute only allowed application and rest all blocked.
It is possible?
Cortex XDR
Regards,
Mansoor
Has anyone installed a Cortex Agent on a high performance database server such as PostgreSQL? We are reaching the point in our rollout where we will need to decide if this is something that we can do without negatively impacting the performance of o
...
Hi All,
Does the Cortex XDR agent fetches endpoint serial number ?
If yes, where I can find it in the XDR console(Under which field).
Thanks in advance !!
Hi !
Does anyone know how long alerts/incidents will be visible in Cortex XDR ?
In our tenant we have alerts older than 1 year and I was wondering if they disappear after some time or if they will be accessible forever but I can't find this informati
...
Hello,
Even though we have added the file hash to the BLOCK LIST, XDR still alllows the process to run. Does someone know the reason for why this is occuring.
When running a query for Files
The file size when the sub type is "create" is always 0
When sub_type is "open" it does show the correct file size
Is the file size not available during a create event?
Hey!
We have different teams looking at different incident sources.
Is there a way to report a widget or report that displays new incidents coming in for a specific Incident Source?
Example:
Only XDR Analytic BIOC alerts would show up in this f
...
Hello dear community,
has anyone of you a XQL Query for this type of attack?
https://www.bleepingcomputer.com/news/microsoft/new-dfscoerce-ntlm-relay-attack-allows-windows-domain-takeover/
BR
Rob
We have several hundred Global Protect users using Auto VPN. It would be nice to
see their global protect logs, ipconfig /all, netstat -rn information before calling them
back on a filed ticket. Can Cortex collect these logs on a regular basis without
...
Hello , is there any way in cortex XDR to block executions without whitelisting/blocking the hash/file path and not get
any incident or alert and at the same time.
Hi,
I turn on the Host Insights free trial and not see any information on Host Insights,
when i did that to other customers ther all working well but at this one its not working, what is the problem?
i did calculated again, i turn that on week ago.
Hello
Please share any experience or advice for below situation and how best to approach this .
Currently agents are connected to UK Cortex XDR tenant via a Broker VM installed on premise . Now the need is to use EU Cortex XDR tenant ,this will
...
