Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Resolved! Cortex XDR Windows Event Collector

Hello!I set up Windows Event Collector and data is coming to XDR. But i want to see data which come from Windows Event collector. In which category this data located? How can i search Windows Event collector data in XQL? THANKS!

XDR Global BIOC rules

Hello.If Restrictions profile for Windows is default then they don`t directly affect windows endpoints. We must edit and and apply them for getting protection in endpoints. But in Linux it is not same. Even if Restriction profile is default, XDR can generate alert base on global BIOC. I want to know why there are such difference? Thanks!

Cortex XDR Broker VM (proxy server)

Hello.In XDR Broker VM i enable proxy server and configure as follows:Type:HTTPAddress: 192.168.6.167Port: 8080 But it is not work and in configuration status i see "in progress" even through 3-4 hours.I want to know if is there anybody who configured this proxy successfully and how? Thanks!

Resolved! Uninstall agent rom MacOS

Hello, We want to uninstall an agent from MacOS, but we do not have the admin password. And we can't reset the password because the tenant was deleted it. So the agent does not have administration from web console. I try with "Passowrd1", it doesn't work. Does someone know how to uninstall it? I know that for Windows, there is a "special cleaner...

Resolved! Piloting XDR 7.3.1, policies seem more stringent- blocking previously allowed scripts and .exes

We are in the process of updating our endpoint XDR agents from 7.2 to 7.3.1. We are testing on a small pilot group and finding that scripts and executables that we previously ran are now being blocked. Granted some these scripts are stopping and starting services and removing files. We are concerned if we deploy it site-wide that we'll have m...

Cortex XDR Windows Event Collector

Hello!My question is about Windows Event Collector.Why we need Windows Event Collector? Don't XDR Agents collects all needed information from Windows endpoints? Can Windows Event Collector give us useful information than Agents?

Cortex XDR files modified

We have some systems that are locked-down with software that prevents modifications to files/directories, and I'm wondering what are the paths that Cortex needs to be able to modify? For example, when it downloads the latest definitions, what does it need to modify? Is there any data stored in the registry as well?

May 4, 2021, 8 AM - 10 AM PST: XDR Alerts AMA [Ask Me Anything] Event

Join our AMA session on 5/4 from 8 AM - 10 AM PST and get answers to your questions about Alerts for Cortex XDR! For details, please review this article. To participate in this event, please join the discussion. We can't wait to guide your Cortex XDR journey!

Creation of "Cortexuser" in redhat after of agent instalation Cortex XDR (Linux Agent)

why? When installing the cortex XDR agent on redhat, a user "cortexuser" is created, what it does and what privileges this user has. Is it necessary for cortex execution?

install Cortex XDR for AWS elastic beanstalk server

Dears Is there any tutorial how to install Cortex XDR in AWS elastic beanstalk server? Thanks

Need advice: Creating dynamic group using define alphabet in the endpoint name.

Hi community, Does anyone know how to create dynamic group using define alphabet in the endpoint name.For example, my endpoints name is ABCP7ABC. I want to create a dynamic group just showing endpoints that have P7 after the first 3 character and not any endpoints that contain P7 (e.g ABCP8ABCP7). Thank you.

Resolved! About Behavioral Threat Protection (BTP) rules

Hi Everyone：Does anyone know where I can find Behavioral Threat Protection (BTP) rules?For example, a behavioral threat is detected (rule: pp.epm_for_malware_behavior_j01)or Behavior threat detected (rule: bioc.pp.ransom_prevention_final)What do these two rules mean?Thank you Richard

Resolved! Cortex xdr 7.0 and 7.1 agent end of life

Hi All, We need to upgrade the cortex agent from version 7.1 to 7.3 via console. My concern is how can we exclude a certain range of endpoints (Suppose we have 5000 endpoints and we want to exclude 800 endpoints) from upgrading. I have created an endpoint group that we want to exclude. but not sure how to exclude. Can anyone please advise? Rega...

Resolved! Duplicate endpoint

Hello, I regularly reinstall my endpoints. This creates duplicates for me and it's difficult to locate all the duplicates. Is there a query to see all endpoints as duplicates?

Resolved! Cortex XDR/Data Lake

Hello. I can not see any logs in my Cortex Data Lake. Also when i go to Explorer app in Hub it is empty. Firewall Logs is also seem empty( I forward logs to Data Lake with Broker VM from Fortigate). Can anybody explain me this situation? NOTE: I have Cortex XDR Pro per Endpoint and Cortex XDR Pro per TB licenses. Thanks!

Discussions

Welcome to the Cortex XDR Discussions!

Resolved! Cortex XDR Windows Event Collector

XDR Global BIOC rules