Cortex XDR Discussions

Automatic status assigning of Incidents

Hello,

The Resolved- False Positive incidents are automatically getting assigned to Under Investigation even though there are no updates or alerts regarding the incident.

The above keeps on repeating every day. Any idea why this is happening and

...

DTRH: Scripting Anything and Reaping Data

DTRH: Scripting Anything and Reaping Data

Overview

Customers are always asking for additional capabilities in the product and often times these feature request may come during a POC where having that capability can be the deciding factor in wi

...

Resolved! Alert from which source/rule?

Hello!

We have some alerts which show us a large upload.

My problem is now, I saw other clients uploading a ton of bytes, but this Alert wasn't fired.

I also cannot find any Rule for this.

Where is it comming from?

BR

Rob

Resolved! Cortex XDR block explorer.exe, network interfaces and other programs - PC (Windows) isn't usable

Dear Live Community Members,

I have an issue and I'm struggling to find the reason behind it and need your help.

To give you some background on the problem at hand, my customer installed the Cortex XDR agent, and it works fine on some machines bu

...

Resolved! XQL query with multiple values

Hello Community,

I'm been using the platform for a couple months and recently I'm getting interested in XQL query.

My question is how to I simplify the search string if i have multiple values that I need to insert?
With the example below, i'm lookin

...

XDR_DATA logs ingestion to splunk

I am thinking of a way to bring in xdr_data dataset logs which we see in xdr query builder to splunk.

As of now i am ingesting the alert and incident data from cortex xdr into splunk.

Can anyone suggest, how i can achieve this?

Cortex XDR Query Builder

Hello Community,

Was wondering whether someone could assit me with an issue.

So at the moment i cannot make any search via the "Query Builder".

When i move to query center and create a custom query i can only return results when i search "dataset = pan_

...

Resolved! Event_Sub_Type Failed to run

When running this XQL query if I add event_sub_type to the filter it fails to run

I can run the query without any filters, and then add the event_sub_type column without issues

dataset = xdr_data
| filter event_type = ENUM.FILE and (event_sub_type =

...

Upgrade agents locally

Hello,

Is there any option available to upgrade agent from local agent console? (Eg: If local IT team can upgrade agent from endpoint directly)

Thanks

Windows defender and calc abuse for dll sideloading

Hello dear community,

Has anyone build a xql query for this case:

https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/

Should this help?

https://live.paloaltonet

...

Resolved! Can't register Broker VM

I downloaded and setup the Broker VM Virtual machine in Hyper V on a server 2016 computer, I log into the IP address, go through the setup steps, test my connection to the time server, then click register and paste the token from the page I got the V

...

Resolved! XQL "call" functions from scripts library

Hi Peeps,

So XQL has this call function to fetch results from a saved query in the query library. Lets take this for example:

call "All appdata executions for the past 30 days"

Now, the problem is that my saved query is waiting for a parameter

...

Endpoints not being reflected on the XDR console

Hello ,

We are facing an issue where an endpoint will be reflected on XDR console but after some time the same endpoint will not be seen on the console . Somehow it will come again after a while or a day or two. Does anyone know why this might be h

...

Resolved! Xdr ramsonware test is not detected

Hi. We recently we have acquired a solution to test our systems.
In one of the tests, we have detected that Cortex does not detect attacks, such as using util control with .net injection.
The test machine has created a malware profile with everything l

...

Installing cortex agent automatically through AMI

Hello .

Is there a way to create AMIs to be added to the already existing AMIs which can be deployed to the servers so that Cortex XDR agent gets installed automatically without manual intervention.

Thanks

Discussions

Automatic status assigning of Incidents