Hello dear community,
how can I find out with Cortex XDR PRO (non per TB, non connected Firewall, etc.), which data was uploaded in this example? Has anyone an idea or script to do so?
BR
Rob
Hello dear community,
what is the best way to setup a query for bioc to get an alert. Maybe correlation rule is a better place for my project?
It should alert, when a XLL File was written or read or deleted.
Should I setup a specific file location
...
Hello dear Community,
has someone of you a ready to implement XQL Query for downloading zip/rar/iso file containing a iso? The source can be outlook, etc.
I found a sigma rule based on:
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/
...
Hello,
The Resolved- False Positive incidents are automatically getting assigned to Under Investigation even though there are no updates or alerts regarding the incident.
The above keeps on repeating every day. Any idea why this is happening and
...
DTRH: Scripting Anything and Reaping Data
Overview
Customers are always asking for additional capabilities in the product and often times these feature request may come during a POC where having that capability can be the deciding factor in wi
...
Hello!
We have some alerts which show us a large upload.
My problem is now, I saw other clients uploading a ton of bytes, but this Alert wasn't fired.
I also cannot find any Rule for this.
Where is it comming from?
BR
Rob
Dear Live Community Members,
I have an issue and I'm struggling to find the reason behind it and need your help.
To give you some background on the problem at hand, my customer installed the Cortex XDR agent, and it works fine on some machines bu
...
Hello Community,
I'm been using the platform for a couple months and recently I'm getting interested in XQL query.
My question is how to I simplify the search string if i have multiple values that I need to insert?
With the example below, i'm lookin
I am thinking of a way to bring in xdr_data dataset logs which we see in xdr query builder to splunk.
As of now i am ingesting the alert and incident data from cortex xdr into splunk.
Can anyone suggest, how i can achieve this?
Hello Community,
Was wondering whether someone could assit me with an issue.
So at the moment i cannot make any search via the "Query Builder".
When i move to query center and create a custom query i can only return results when i search "dataset = pan_
When running this XQL query if I add event_sub_type to the filter it fails to run
I can run the query without any filters, and then add the event_sub_type column without issues
dataset = xdr_data
| filter event_type = ENUM.FILE and (event_sub_type =
Hello,
Is there any option available to upgrade agent from local agent console? (Eg: If local IT team can upgrade agent from endpoint directly)
Thanks
Hello dear community,
Has anyone build a xql query for this case:
https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
Should this help?
https://live.paloaltonet
...
I downloaded and setup the Broker VM Virtual machine in Hyper V on a server 2016 computer, I log into the IP address, go through the setup steps, test my connection to the time server, then click register and paste the token from the page I got the V
...
