Removable Media Extension Profile

I wanted to get everyone else's 2 cents here and see how other people are doing it. My goal here is to prevent writing data to unapproved removeable media but allow reading. I created an device configuration extension profile with disk drives set as

Alert for each time a usb device is plugged

Hello,

Is there any way to set up an alert for each time a USB device is plugged into a host?
Even if it's not malicious.

How to make console accessible to domain user?

Hello!

I'm new around here and I have a question.

How to make Cortex XDR console to be accessible only to domain users?

So only users connected to the domain network can access the Cortex XDR Console.

It'd be very helpful if you provide related document

Cortex XDR has Blocked a Malicious Activity but No Program Listed

Attached images show the pop-up that is going around our network this morning.  Unlike before where it would list the program Cortex blocks there is nothing there and is pointing at Microsoft for the cause.

Is this a false positive?  A windows servic

Http logs collector example not working

Hi
hope this is the right place to ask this question
We were given a temp user to play around with the Cortex XDR and we are trying to insert some dummy data into it.

I am trying to insert data using an Http logs collector, following this guide
unfortuna

Analytics BIOC Rules - Causality Change - No. of alerts rising, but where to see who, why and what?

Hello Admins, 

We use Analytics BIOC Rules. But where is the Causality Change? No of alerts rising, but where to see who, why and what?

Thank you! 

BR

Rob

How can Cortex XDR Pro find the origin process from a DNS request if the process not uses DnsQueryEx RPC Call

Hi Community,

Is somebody able to explain if Cortex XDR Pro is able to find the origin process if you have the DNS Query? A lot of windows internal process uses rpc calls to a svchhost.exe, which then makes the dns resolving, which is cortex xdr pro t

Servers unable to complete scan job within 24 hours

We have some servers in our environment that have a lot of files. The scans are scheduled for 2am Saturday mornings, but do not complete within 24 hours and the scan times out and is then cancelled. 

What are the steps to remediate this.

XQL - Hunt for Kerberos Relay Up Activity

Just posting, if this is useful for someone who might be hunting for Kerberos Relay Up (Privilege Escalation on Windows System) Activity.

The purpose of this hunt is to look for suspicious logon on windows system using Kerberos Auth Package where the

XDR Analytic alert

I am not able to see all cortex XDR analytic alert on Console that is mentioned in the document . why ?