SD Card Blocking on MAC OS

Team, Please let me know whether we have an option to block in-built SD Card Readers in MAC Machines.

Thanks!

Getting tags from EC2 instance.

Hello, 

We have multiple tags assigned to hosts as part of EC2 instances. Is there a way we can reflect those tags in the XDR console.

Thanks !

Populate data from the host

Hello, Is there a way to get data that is there on the host and then populate it on the XDR . eg. get tags available on the host and then automatically populate it in the XDR console?

Populate data from the host

Hello, Is there a way to get data that is there on the host and then populate it on the XDR . eg. get tags available on the host and then automatically populate it in the XDR console?

Cortex XDR Auto update mechanism

Does anyone know the Cortex XDR Auto update mechanism?
I recently found that some agents failed to update automatically. The failed content included content update and agent update. The console log did not give the reason for the failure. What are the

Behavioral Threat alerts for sdiagnhost.exe spawning cronhost.exe - false positive?

Hi community,

Wondering if anyone else is seeing BT alerts for sdiagnhost.exe appearing over the last 24 hours? We have had similar things occur in the past due to over excited signature updates cause false positives.

This process is one that MSDT

Incident question - svchost without signature?

Hello dear community, 

you know how to handle this svchost.exe without signature? In my opinion it is FP, but why?

Isn't it possible for the cortex agent to read the signature from svchost.exe in this case?

I tweaked the alert and gave it m

Global Rule a4978720-39fc-404f-bb74-c3db07ef4f9d - ISO mounted manually questions

Hello dear community, 

in my mount tests I could find out following:

- if you mount the same file name 2 times with different file data inside the iso, the alert isn't created because the file isn't beeing created. I think the recent folder is no

What was uploaded to google storage?

Hello dear community, 

how can I find out with Cortex XDR PRO (non per TB, non connected Firewall, etc.), which data was uploaded in this example? Has anyone an idea or script to do so? 

BR

Rob