Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

CORTEX XDR - Best practices

Hi everyone ! I'm a beginner on CORTEX XDR, and need some help for 2 things ! - First, my client want to know if it's possible to schedule a Malware Scan based on the CPU use. I mean, they have around 500 computers, which are used in so many different teams, with various work hours. They need to schedule scan when the computer is alive, but when...

Resolved! XQL datasets

Is there a comprehensive document containing all the datasets that are currently available? We've noticed that datasets such as "incidents_artifacts" or "incidents" are not displayed in the autofill text in XQL. We would greatly appreciate having a complete list of all the datasets that are accessible.

Creating an Exception Rule for a PT Automation System

I have recently encountered a unique use case; we are working with a PT Automation System in which PT attacks are simulated on endpoints within the organization. This is causing quite a ruckus on the XDR tenant as expected in terms of alerts. Is there a concrete solution to create an exception rule for actions performed by this host ? We have e...

Allow based on certifcate issuer?

We are currently having an issue with our database disk images being blocked that are set on rotation cycles. The file name and the hash changes incrementally. All our disk images are signed, using a certificate by the issuer; this was used previously to stop these executables from being blocked. Is there a way to exclude or allow based on the c...

Resolved! Broker VM offline in Cortex XDR

Hello I've a broker VM that is offline in Cortex XDR, do I need to remove the offline broker VM from Cortex XDR then register it?

Resolved! Response Action

There is an option Response Action under agent configuration, which means we can allow access to a certain application in case the endpoint is isolated. Which application access should ideally be provided in it. Thanks

Network Location Files in Restrictions Profile

Hello Team, Could you please provide the benefits of Network Location Files in restriction profile.

Resolved! Yara Rules and Cortex XDR

I have seen alerts screenshot on internet where an alert triggered after matching a Yara rules. https://attackevals.mitre-engenuity.org/enterprise/participants/paloaltonetworks?adversary=carbanak-fin7&view=results&scenario=1(Fourth Screenshot) Does Cortex XDR uses Yara Rules? I mean the screenshot answers it but how? Do we need to upgrad...

Resolved! XDR Installation on Azure

Hi All, Can XDR be installed on VM deployed via Azure marketplace images? Thanks

Resolved! XQL Command Line Help

All, Trying to write a XQL query to search for this Windows command line when executed. Can anyone tell me how to distinguish the command line parameters "domain computers" in XQL? Thanks. actor_process_command_line = "%systemroot%\system32\net.exe group "domain computers" /domain"

Resolved! Cortex XDR malware scan

Hello , Does anyone know the difference between the Malware scan initiated from console and Scan initiated by user locally for all drive? Does cortex XDR also scans the memory and registries in the full scan initiated? and how long it should take a system or agent to timeout the scan it it continues in progress for long time. Cortex XDR

EvilExtractor

We have concerns about the Evil Extractor malware posted here: https://www.fortinet.com/blog/threat-research/evil-extractor-all-in-one-stealerI have not been able to find anything on the PA Cortex or Firewall Pages and need to get information back to my CIO that we are protected by PA on this. Thank you for a prompt response.

Resolved! Reporting in Cortex XDR Pro on more pages

Hello dear community, my supervisor needs a monthly report about still vulnerable agents. I got allready an XQL, which I used for the dashboard. config timeframe between "-1y" and "+5d" |dataset = host_inventory| arrayexpand kbs| alter kbnr = json_extract(kbs , "$.name"), install_date = json_extract(kbs , "$.installation_date")| fields ho...

Hunting for Keywords - How to do that in Cortex xdr Pro?

Hello dear community, how could this keywords be integrated into cortex xdr pro? https://mthcht.github.io/ThreatHunting-Keywords/ happy hunting! BR Rob

Cortex XDR | Azure AD Single Sign On Unauthorized. Error 4011

Hello all, I am trying to setup SSO on my XDR tenant but I am getting the following message when login inUnauthorized. Error 4011 In the console, the status is 401 Unauthorized I followed this video https://www.youtube.com/watch?v=nwF3hY3wgc0 The test user I created for this purpose should have the right access and in the right group, I d...

Discussions

Welcome to the Cortex XDR Discussions!