Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Resolved! Block Exe Files in User Download Folder

Hello, i know that i can block specific files in cortex but i am looking for a solution how i can block only .exe files in Users download folder. In the Malware Profiles i can see that there is only a allow list where i can write single filenames that will be allowed. Do you have any idea how i can realise this? Best Regards Sascha

Traps anti-tampering supervisor password needed

In a document provided by my company some time ago, we were asked to install Traps on our personal computer, however, I found that it blocks certain programs(video game) when I'm not working. It seems it's not possible to uninstall this and a supervisor password is needed. I can't find this documented within our company and from initial conversa...

Resolved! Network Configuration Module

Hello, What exactly is the use of the feature called active assets and active managed assets in the IP ranges section under the Network configuration module.

Applications hanging on terminal server since Cortex XDR Pro rollout

Hello dear community, what is your expirience with slow applications when printing, saving documents (not responding) on a terminal server? Yes, there are over 30 users on it and it was a bit slow before cortex xdr pro rollout. But now it is terrible slow where users use java applications. Please let me know what can be done in this scenar...

Resolved! XDR Scan

Hello, 1. If we create a policy related to scanning of endpoints and apply that policy in all the machine and run it on all the machine at the same time. Is it this method possible? Will it create any issue?2. Pop up messages to users for malicious files during malware scans - Is this possible? If yes, is it documented? please share.3. What i...

Logs not visible - XQL Query

Hello, Currently we are trying to create a query that gives us the result if the user has executed Sudo command and then right after executed the cd command. Is it possible to write a query that searches for commands executed one after the other? During this process we observed that cortex is not giving us logs for cd command in any of the s...

Login details in Cortex XDR

Hello, We are trying to create a quarantine policy for machines that are not connecting to the console, so we are checking if NAC solution can fetch these details and based on that policy can be created. And also, where (file path or file name) can we find last-check-in details locally on the machine apart from the Agent console?

Resolved! Which one is better between cortex XDR host firewall and windows firewall ?

Hi All, Is it a good idea to enable the XDR host firewall to manage all endpoint communication? or is it better to keep the default windows firewall enabled without using the XDR firewall? I would be happier if someone suggests any article/documentation links which show a comparison between the XDR firewall and windows firewall in terms of f...

rare iptable delete command

We received couple of alerts on rare iptable delete command.On checking the host activity, we could able to observe all commands including newly entered command in the host machine but not able to see the iptable delete/flush command in the activity log under Query builder.

Resolved! Cortex XDR Broker VM handling

Hello dear live community! We are now at the step where we connect some Servers to Cortex XDR which should not connect directly to the Internet. In the first mind we talked about the Tier 0 server. Today I was asked why we cannot bring all the server under the umbrella of the Broker vm. I am a little bit unsecure to put about 100 server ont...

Integration between CDL and Rapid7 InsightIDR not working

I am working on the integration between CDL and R7 IDR SIEM and this is not working. I don't get pass the test connection on CDL. https://docs.rapid7.com/insightidr/palo-alto-cortex-data-lake/ https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-log...

Log BrokerVM license has expired.

We receive an alert Management Audit Log: Broker VM XXXXXXXX license has expired - Deactivating applet XXXX. I'm not sure about this log, someone please help suggest us. Cortex XDR

Resolved! Quarantine behavior when changing profiles

If I change a laptop's malware profile from having quarantine features enabled to disabled do the files in quarantine get released?

Execute a program in my endpoint from live terminal Cortex XDR

Hi everyone, has anyone tried to execute a program in an endpoint from live terminal? I mean, when you are in the endpoint you can use a command like c:\notepad.exe in cmd and it opens notepad, I want to do the same but from the live terminal, I tried but I didn't have luck, it doesn't open the program. I really appreciate any help you can ...

Resolved! after cortex XDR 7.9.0.17288 upgrade endpoints in cortex XDR console got removed from existing dynamic group

Hi All, I have recently upgraded cortex XDR agent 7.9.0.17288 on few endpoints. After the successfull upgrade, i saw the endpoints which were upgraded with new version got removed from existing dynamic group. Those are still member the same group in AD, but not listing in the cortex XDR dymanic group. Is this expected behavior?

Discussions

Welcome to the Cortex XDR Discussions!

Resolved! Block Exe Files in User Download Folder