Modify Alerts Going to An Endpoint Group

Hello all,

I have setup an endpoint group of high profile laptops.  I would like the following configured on XDR.

- Prefix all Incident names going to endpoints in that group with "VIP Endpoint [Incident Name] (e.g. VIP Endpoint Wildfire Malware Dete

How most decisions are made by Cortex XDR ?

Greetings ,

I am using Cortex XDR Prevent and keen to know how most decisions are made by Cortex XDR about File/process/macro being malicious or not ?  So assume there are no Hash exceptions and need to know if below is true :

- First Wildfire cache i

Malware Scan for Linux OS

I know that Malware Scans are not currently available for Linux OS. Just wondering the reason for that, and if there are any future plans to enable malware scans for Linux devices?

Mac XDR network content filter, keeps disconnecting and reconnecting

Every 10 seconds, it goes offline and rejoins the network. Anyone see anything like this? 

Seems to be affecting everything connected form the mac machine(s). Latest version of XDR agent..

Cortex XDR incidents view by module

Hi

I am not able to view incidents viewed by modules.

So I want specific to see all incidents detected/blocked by Behavioral Threat module.

Anyway to view this 

/Jacob

False positive detection

I'm representing a productivity management software manufacturer and I'm sumbitting this request  to report that our software is being flagged as malware, but this result is a false positive. Please, can you help us?

• File HASH: 8475477dd7cdb0493e2d5d

Usercentric.Exe on MS Teams

Hi,

There are recent articles on MS Teams security incident. Attackers attach usercentric.exe files to Teams chats to install a Trojan on the end-user's computer. This Trojan is then used to install malware that self-administers the computer.

Does Co

Cortex XDR Delete Malware

Hello 

i see alert malware in incident report . how i can delete malware from Cortex XDR admin portal. 

Agent version 7.0.2

XDR external syslog encryption

Hi all,

Im trying to set up encrypted communication to a syslog server from the XDR using a self signed certificate.

However I cant seem to get it to work - the XDR says that no connection is available.

I should note that without the certificate, on reg