Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Whitelisting of Files

Hello, We are running periodic scan on all endpoints . During this scan few files has been detected .We have got confirmation that some of the files are legitimate and it's being used in infra. Can you please suggest in providing what is the best method to whitelist the safe and confirmed files .

Resolved! XQL Query help is required to narrow down our requirement

Dear All, We are trying to understand that, there are certain applications installed on a host by using the below query. preset = host_inventory_applications|filter endpoint_type = "AGENT_TYPE_WORKSTATION"|filter application_name in("Application A","application B", "Application C") | comp latest(report_timestamp) by endpoint_name, application_...

Block a digital signer?

Does anyone know if there is a way to block a digital signer? Or does anyone have any better ideas for blocking Wave Browser without blocking all of their ever-changing thousands of hashes?

Resolved! XQL Query Help

Dear All, We wanted to pull the list of applications installed on our devices and would like to use XQL query to list the applications that are installed, we tried the below with no results, can someone help me how to get this achieved. config timeframe = 24h | dataset = host_inventory | filter application_name in("Application Name that...

Resolved! Cortex XDR iOS App

Hello - Is there a Cortex XDR agent app for iOS, or will there be one in the future? Thank you,Joshua

Resolved! Host Insights

How can we leverage host insights to make our investigations bettter?

Visualize Running processes through XQL and send alert?

Hello dear community! is it possible to visualize through XQL a prozess which was not terminated and is still running? In the causality view it is visualized, but I would need it to create a alert. If a special process is still running, get a mail through correlation rule or bioc rule. What do you say? Is that possible? BR Rob

Resolved! Cortex XDR Alerts

Hi, I can't seem to find what I'm looking for in the Cortex XDR console. I am trying to find a way to view all alerts generated whether it is from XDR or Analytics. The only way I can see this list is if I create an exclusion Investigation --> Exclusions --> Add Exclusion. Is there a more direct way to view these Alerts? Thanks

Cortex XDR Alerts not found after resolving

We have resolved some alerts in Cortex XDR by adding the initiator path to allow list of specific policy but those alerts are not visible in the Cortex XDR alerts console anymore and neither in the management logs. Cortex XDR @Cortex-support

Cortex XDR

Hi people, 1) I have installed the cortex XDR on end user PC and when I tried to scan email attachment on the end user PC I am not able to see any option to scan email attachment. I am a system Admin and I want the end user to scan email attachment with cortex. At present I have to download the attachment and do scan with cortex. I don't want to...

Integrate Cortex XDR with the SIEM (Microsoft Azure) solution

Integration of Cortex XDR with the SIEM (Microsoft Azure) solution Had a few queries regarding it:- 1. Supported integration methods & recommended integration methods for integration with Microsoft Sentinel.2. What all logs can be forwarded (eg: Alerts, Incidents, Audit, management logs and endpoint/server logs, etc.)3. How do we evaluate di...

Help! Upgraded to 7.8.1.11343 now all clients can’t run certain applications

We upgraded our clients from version 7.7.X to 7.8 and things like Visual Studio and Gitkraken and homegrown apps fail to run. No logs and really no errors other than just crashes or freezes. I pause XDR Agent and it runs fine. Anyone else experience this issue? I am at a loss

XDR agent install rolls back

Hi all, Has anyone ever had it where an agent will lose connectivity with the management console and will not reinstall afterwards? I have an endpoint that lost connectivity with the console. Would not check back in. I removed it via the Control Panel and when I went to reinstall it, it looks fine and then towards the end it rolls back the up...

Adding Endpoint to Dynamic Group by "Installation Package" Name

Hi there, Recently I have received a request from client that they would like group endpoint automatically by the installation package, just like their previous deployment of their existing endpoint agents. Since it is much less admin overhead and straight forward for their deployment method e.g. push endpoint installer by department. Firstl...

Outdated content update

Hello , What could be the possible reasons for outdated content version despite the agents running in the latest agent version .

Discussions

Welcome to the Cortex XDR Discussions!

Whitelisting of Files

Resolved! XQL Query help is required to narrow down our requirement