Cortex XQL help

Hello Dear Community, I want to count events based on specified time periods. For example I want to query hosts that scanned more than 50 hosts in 10 seconds. How can I write XQL in that case?  

Cortex XDR 

Cortex XDR Host Firewall - Use it public WAN?

Hello dear community, 

are you using the above mentioned module on windows notebooks with public routable ip addresses? 

Is this firewall module recommended for such public facing scenario?

BR

Rob

Running an XQL Scheduled Report Email If a Result is Found

Hello, 

I have a working XQL query that deals with Host Connectivity. Can I configure this to run as a scheduled report and only if there are results the report can be sent by email? 

I do not want to receive empty reports. Can this be done in XQL or

Data Ingest per Source for Palo Alto Firewalls in Cortex XDR

I do not think this is in the correct Board, but I could not find a Cortex XDR channel.. First time posting so I am sure I missed it. 

I have Cortex XDR and we are trying to see what firewall is sending the largest amount of data by GB Ingest. We a

How can I see the device control violations logs from XQL?

Good afternoon,

Is there a way to see the logs that are generated in Device control Violations?

I know that using preset = device_control in XQL we can see devices but this preset does not give me all the data that appears in the Violations section..

Kernel Module is Disabled - Status STOPPED - help installing

I followed the instructions on the website,and there was a problem

XDR agent was successfully installed on CentOS, but it is visible on endpoints all endpoints

XDR agent was successfully installed on CentOS, but I saw it on endpoints all endpoints. I checked the installation logs to ensure that it was installed successfully.

The XDR agent communicates through the broker VM, and their communication is also

Cortex XDR DNS Collectors

Hi community,

I have a query regarding Cortex XDR collectors. When installing collectors on the local DOM servers, what types of logs does the Cortex XDR console retrieve? How can these logs help with the investigation of incidents?

Move Cortex XDR agent from one tenant to another (and back)

When we move an agent to a new management server, what would happen to the logs and telemetries we have on the old tenant? Would they be retained as per the usual policy or would they just get purged?

Also if we then move it back to the old tenant,

Upgrade agent failed

I have encountered the following issue of failed agent upgrade on a Windows laptop, showing the following message:

XDR Agent failed to upgrade from version 8.4.0.51691 to version 8.5.0.624 on LAPTOP-xxxxxxx with error: Windows Installer DB: Current

BIOC RULE Creation - Workstation IP changed

Hi,

How we can monitor the scenario like,  when a cortex connected workstation's IP address change?

Whether it is possible to create a rule/bioc in cortex xdr for monitoring the above mentioned scenario ?

Cortex XDR Cortex Data Lake 

Thanks

Chr

GPU passthrough in VM (hyper-v) gets roll back automatically

I am using Hyper-v VM's on windows 2019 server 

After automatic deployment (not managed by me) of Cortex XDR agent version 8.4.0 on that server 

Assigning GPU's from host to the VM's getting roll back automatically within seconds in front of my eye