Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Resolved! Cortex XDR Windows 11 ARM Support?

Are there any talks about Cortex XDR support for Windows 11 ARM?

Query to get the number of the operating system.

Hello,

I have used the below query to get the number of the operating system.

dataset = endpoints
| filter endpoint_status = CONNECTED
| alter operating_system = to_json_string(operating_system)
| alter operating_system1 = regextract(operating_system ,

...

Cortex XDR Agent license

If we keep Agent Status Configure the Cortex XDR Agent license revocation and deletion period connection lost as 30 days and Agent Deletion days as180 days will the entry be deleted from the console will it delete logs also for the deleted entries be

...

Resolved! XQL Query for Endpoint DNS Requests

Does anyone know a way to search DNS requests from an Endpoint? Seems like it should be possible with XQL Query but I can't find the right fields.

Resolved! Cohesity Agent keeps triggering powershell alarm in cortex xdr

I have witelistet choesity agent but i keeps trigger

PowerShell script executing with iex from suspicious script source - Behavioral threat detected (rule: dotnet_iex_suspicious_source)
Sep 30th 2022 16:04:40 SYSTEM powershell.exe 25384 29488 Proc

...

How can i Search multiple endpoint in cortex xdr in way

is there any way that i can search bulk of endpoint in cortex xdr in one go or any other way to search the endpoints, as one and one to enter in console and search is very hectic.

Resolved! Broker vm only for network mapper

Hi all,

is it possible to use a broker vm just for network mapper without using it as a real broker vm?

I don't need to modify my Cortex installation way of working, I just want to scan my network for missing cortex installation.

Thanks

How to delete endpoints from ALL ENDPOINTS

Hi,

we are the delete endpoint option from all endpoints by right-clicking..

But they keep on appearing back on XDR any reason why?

Resolved! Export and Import excluded alert Cortex XDR

Hi,

I wonder if there is a method to export the excluded alert from a Cortex XDR tenant and import this exported excluded alert into another Cortex tenant.

If I export the alert from the console filtering the alerts excluded=yes, I can download a .ts

...