Resolved! Uninstall process for disconnected XDR on endpoints

Greetings,

I have a client who engaged Unit 42 last year, and had Cortex XDR installed. Now we are trying to uninstall Cortex XDR. Tamper protection is still enabled. We do not have the uninstall password. The endpoints are showing they are not con

Resolved! Traps and Cortex co-existence

Thanks in advance for help 

We have few Linux Servers and they have Traps 4.x installed , Traps as you know is previous product of Palo and now its replaced with Cortex XDR .

We wanted to remove Traps and install Cortex XDR 7.x . We wanted to kno

Resolved! Broker VM and connection to the agents visibility

Hello dear community, 

now I setup everything what I needed to get an agent running with the broker vm. The agent is also connecting through P2P and directly to the server. 

But where and how can I see, if the communication is ok through the broker

Resolved! Deactivating UAC should be alerted

Hello dear community, 

I tested to deactivate my UAC, which was possible without any alert. 

In my opinion there should be an alert triggerd. What do you think? 

https://twitter.com/Computeus7/status/1562497080048119808

Reg Add "HKLM\SOFTWARE\Mic

Resolved! Eventlogs / Agent / Rules from baseline / XDR Pro per EP

Hello dear community, 

Cortex is gathering some eventlogs. 

I am about to activate the powershell scriptblock events.

The main  question is, does any ML or BIOC check the eventlog for bad behaviour?

Or do we have to create our own rules? 

Yes I am

Resolved! Cortex XDR blocking TeamViewer again....

Hello everybody,

in the night from yesterday to today Cortex XDR disabled and quarantined TeamViewer (tv_x64.exe to be more specific) on a lot of our devices. We are using TeamViewer to offer support to our external offices. Does anybody else have

Resolved! Excluding files from local malware analysis scan

Hi all,

I have a specific file that i would like to whitelist. I have it in the allow list(by hash) but it still sometimes blocked by the "local analysis malware" due to having a different hash than the one in the allow list.

Is there a way to exclude

Resolved! BIOC Analytics Specific Exceptions and Vendor Exceptions

Hello all,

I have encountered multiple occurrences in which a specific process raise many of the same BIOC Analytics Alert. I understand that engine is based on server side and as a customer we are not privy to see what calculations are done on our b