Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Resolved! Researcher for evading Cortex XDR & my PoC XP

Dear Community, Here I have found a researcher which evaded Cortex XDR protection. https://0xsp.com/security%20research%20&%20development%20(SRD)/defeat-the-castle-bypass-av-advanced-xdr-solutionsAre there any connections to researcher like the one in the link above to penetrate cortex xdr? What can you say to the evasion technic frohe the ...

Update from Traps to Cortex

Hello everyone,I'm trying to update the Traps agent 5.0.11 to Cortex 7.4.0 on Windows Server 2008/2008R2.When I'm installing the new version, in the moment to start the services, the installation go in rollback.I've tried to install directly the new version.Unistall Traps, clean with XDR agent cleaner and install the new version, same problem.I...

There is not enough space on the disk

Hi Expert, I have facing issue about XDR agent.My XDR agent has status no connection in XDR console, but after I checked in the XDR Tenant status for my device has connected status.After I checked logg in agent I find logg c:\ProgramData\Cyvera\LocalSystem\Persistence\\post_detection.db: IO error: c:\ProgramData\Cyvera\LocalSystem\Persistence\\...

Resolved! Blocking Domain/URL

Hi Team, I know we can block IP addresses with new feature called host firewall,.Since the ip is dynamic , its not a good option for me. Is it possible to block url or domain in cortex xdr?

Cortex XDR ransomware response

Hi everyone,I wonder how Cortex XDR would take action if, for some reason, an encription script starts.Until now i have seen that Cortex kill the script at the start, before the encription take action, but what happen if the malware start to encript something?Thanks all for responses.

CORTEX

HelloWe would need to know how this announced incompatibility affects our case and it is necessary to take some action. On the other hand, we do not quite understand what impact the following paragraph has on us: While only Windows 10 version 21H2 and higher are incompatible, the Cortex XDR agent will disable the affected security engine in Wind...

Cortex Xdr Partial protected (7.4)

Hi everyone , we have a problem with some of our linux servers ,the status is partial Protected ,the secure boot is disabledthe kernel supportedthe policy is the same on all servers (also those with status 'protected')the only thing that i find is the ited proccess stopped ,is that can cause the isse?also cant start the Ited by cmd , while try t...

Agent Blocking Command Prompt/Powershell

The agent has been blocking acess to the CMD , The licensing has been expired due to which the dashboard cannot be logined. I tired to uninstall agent using Cleaner but even the Agent Cleaner has been blocked. What sort of procedures i should follow to uninstall the Agent.

Server reboot after Cortex XDR installation is required or not?

Hi, I have one question regarding the Cortex XDR Agent installation, after i install the XDR agent in Servers (Linux or windows), do i need to reboot the server for the installation to take effect or no reboot needed? I am working in Telekom Malaysia Berhad and currently we are having mass XDR deployment for all servers (linux & windows). On...

Resolved! Dynamic group "starts with"

Hi all,I need to create a dynamic group based on the first letters of device name, like "starts with" or "not starts with".I cannot use contains because, for example, I have server name that starts with QQ that should not be inside the group, but servers like ZZQQA01 should be inside.Is there any way to do this?Thanks

Resolved! What is the manual repair snapshot in the repair suggestion?

I saw the following notice in the repair suggestion. It prompts me to repair it manually. It can't be found in the snapshot. What does this snapshot refer to? Snapshot of the system itself? Or can xdr do snapshots?

Resolved! HIPS and Host Firewall

I would like to know whether Cortex XDR has Host Intrusion Prevention and Host Firewall capability. If yes, what is the difference and how to enable.

Resolved! Report exporting questions

I have a custom timer filed called analysttimer, which recording the time analyst spend on an incident, once the incident this field will shows total time spend. I can see the total time is captured in the analysttimer.totalduration field. When create a report, I can only refer analysttimer filed as whole in the widget, rather than directly ref...

Resolved! Behavioral Alert from Vulnerability Scanner - How to Allow Scans WITHOUT alerts from IP address?

We use an on-site vulnerability scanner that started triggering behavioral alerts on Cortex endpoints on Monday. These scans were disabled since they were very disruptive with some endpoints just reporting the issue and others blocking the scan. All endpoints received the pop-up alerting them to danger. These scans have been running since bef...

XDR endpoints not scanning

Is there a way to look at only the endpoints that have not been scanned in certain amount of time?I know I can view all the have been scanned in the last day/week/month etc, but I want to look at the devices that have NOT been scanned. I need a "does NOT equal" button, on the Endpoint Administration tab.

Discussions

Welcome to the Cortex XDR Discussions!

Resolved! Researcher for evading Cortex XDR & my PoC XP

Update from Traps to Cortex