Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Cortex XDR Pro - Tag capability in Asset Management

Hello dear PA community! It would be helpful, when there would be a possibility to tag an IP in Asset Management. We would like to enter the real Asset behind it. They have fixed IPs and we would like to have a chance to work with it. BR Rob

Deploy Broker VM

Hello, Is there any document regarding the steps to Deploy Cortex XDR Broker VM through VMWARE ESXI.

Resolved! XQL query Help for custom XQL widgets

Hello I would like to customize the standard "Detections By Actions" widget to filter only on true positive (resolved) incidents - for the last 30 days. And I would like to customize the standard "Open incidents by severity" widget to apply on all incidents, not only opened ones - for the last 30 days.I suppose it's possible by XQL-query but I'm...

Resolved! XDR Alerts

I want to process the alarms received by XDR. To do this, I first need to separate the incoming alarms according to their class. If I separate them according to source, I should examine them in 4 classes as "XDR IOC, XDR BIOC, XDR Agents, XDR Analytics". Does this cover them all? And is there a source that shows the alarms brought by "XDR Agents...

Resolved! Incident handling - quarantined files not filterable in the incident advanced view

Hello dear community! I whish there could be a column, which could make us see, if the file is quarantined. It just exists in the Executions index tab and there you cannot see in one step if the file is quarantined or not. It would be very helpful, when a column quarantined would be existent. BR Rob

Cortex XDR as part of the golden image

How can we include Cortex XDR as part of the golden image? (for the agent installation on Windows) Condition:- It shouldn't create any duplicate entries on the console. Will there be a new entry on the console if the admin changes the system hostname? Also, If someone changes the name of the host does it create a new entry on the console...

Resolved! Cortex Scanning

Hi, I'm looking at doing a review on our Cortex policies and we currently have weekly scanning enabled. I know scanning for Cortex is not a traditional antivirus scan, but more for creating a benchmark for your endpoints. After it does a scan, alerts get created from things that got raised from the scans. Some of our team members are concerned t...

Cortex XDR 3.5 - Whitelist UI

Hello, How Legacy Exceptions are different from Policy/profiles in Policy management.

Cortex XDR installed on personal computer which was used for work more than 5 years ago

Hi, Hi have this personal computer which I used for work several years ago (5). I started working for another company and stopped using this computer for work stuff. Recently, about a year ago, I started using it again for all kind of things (streaming, tech stuff, gaming, etc.), and a new application has shown up which wasn't installed befo...

Resolved! timestamps for suppression rule (BIOC)

Hello everyone, I need your help because I want to create a BIOC deletion rule, I have the hash, the username and the path but I would like this deletion to be effective during a specific time slot, can it be configured?

Cortex XDR: Block the Exit button with admin rights

Hello, We have noticed that the user can simply exit the XDR on the system tray. Is there any way to block the exit button with admin rights or any way possible to avoid stopping the app? Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial number...

Resolved! Block Exe Files in User Download Folder

Hello, i know that i can block specific files in cortex but i am looking for a solution how i can block only .exe files in Users download folder. In the Malware Profiles i can see that there is only a allow list where i can write single filenames that will be allowed. Do you have any idea how i can realise this? Best Regards Sascha

Traps anti-tampering supervisor password needed

In a document provided by my company some time ago, we were asked to install Traps on our personal computer, however, I found that it blocks certain programs(video game) when I'm not working. It seems it's not possible to uninstall this and a supervisor password is needed. I can't find this documented within our company and from initial conversa...

Resolved! Network Configuration Module

Hello, What exactly is the use of the feature called active assets and active managed assets in the IP ranges section under the Network configuration module.

Applications hanging on terminal server since Cortex XDR Pro rollout

Hello dear community, what is your expirience with slow applications when printing, saving documents (not responding) on a terminal server? Yes, there are over 30 users on it and it was a bit slow before cortex xdr pro rollout. But now it is terrible slow where users use java applications. Please let me know what can be done in this scenar...

Discussions

Welcome to the Cortex XDR Discussions!

Cortex XDR Pro - Tag capability in Asset Management

Deploy Broker VM