Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Mitre ATT&CK coverage

Hello dear Livecommunity, as you know, Cortex XDR is a very powerful peace of software and I am happy to use and administrate it. But I never doubt about coverage of the mitre attack patterns and I am a little bit upset, we need to get through this and setup our own rules for example TA 1219. There is no rule within. Has anyone of you got...

Broker VM & SIEM

Hello folks. How we can forward Cortex Agent logs from Broker VM to SIEM systems? [agent] ====> [Broker VM] ====> [SIEM] Cortex XDR

CORTEX XDR

I want to add palo alto firewalls to cortex xdr do I need to add only panorama or do I need to add Indvidual firewalls to get alert do i need to use firewall mgmt. ip or panorama mgmt. ip we have more than 300 firewalls split into HWAN and LAN MFG

Query regarding malware scan

During initiating the malware scan on connected endpoints suppose the system moves to disconnected state for few days and the scan status starts showing in progress now. Could you please let us know the duration of the malware scan is applicable for such endpoints?

Malware scan is not getting intiated

Hello, While initiating malware scan through policy, for certain endpoints the scan is not getting initiated, and the scan status is "None". How can this be resolved?

How to check endpoint has no agent and intregate edl with NGFW

Hi Expert , How to check endpoint has no agent and integrate edl with NGFW when found endpoint Now , I have try to create python script to get all endpoint but not have idea to check endpoint has no agent Thank you

Whitelisting of Files

Hello, We are running periodic scan on all endpoints . During this scan few files has been detected .We have got confirmation that some of the files are legitimate and it's being used in infra. Can you please suggest in providing what is the best method to whitelist the safe and confirmed files .

Resolved! XQL Query help is required to narrow down our requirement

Dear All, We are trying to understand that, there are certain applications installed on a host by using the below query. preset = host_inventory_applications|filter endpoint_type = "AGENT_TYPE_WORKSTATION"|filter application_name in("Application A","application B", "Application C") | comp latest(report_timestamp) by endpoint_name, application_...

Block a digital signer?

Does anyone know if there is a way to block a digital signer? Or does anyone have any better ideas for blocking Wave Browser without blocking all of their ever-changing thousands of hashes?

Resolved! XQL Query Help

Dear All, We wanted to pull the list of applications installed on our devices and would like to use XQL query to list the applications that are installed, we tried the below with no results, can someone help me how to get this achieved. config timeframe = 24h | dataset = host_inventory | filter application_name in("Application Name that...

Resolved! Cortex XDR iOS App

Hello - Is there a Cortex XDR agent app for iOS, or will there be one in the future? Thank you,Joshua

Resolved! Host Insights

How can we leverage host insights to make our investigations bettter?

Visualize Running processes through XQL and send alert?

Hello dear community! is it possible to visualize through XQL a prozess which was not terminated and is still running? In the causality view it is visualized, but I would need it to create a alert. If a special process is still running, get a mail through correlation rule or bioc rule. What do you say? Is that possible? BR Rob

Resolved! Cortex XDR Alerts

Hi, I can't seem to find what I'm looking for in the Cortex XDR console. I am trying to find a way to view all alerts generated whether it is from XDR or Analytics. The only way I can see this list is if I create an exclusion Investigation --> Exclusions --> Add Exclusion. Is there a more direct way to view these Alerts? Thanks

Cortex XDR Alerts not found after resolving

We have resolved some alerts in Cortex XDR by adding the initiator path to allow list of specific policy but those alerts are not visible in the Cortex XDR alerts console anymore and neither in the management logs. Cortex XDR @Cortex-support

Discussions