Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

Rules and Best Practices

Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion

...

Resolved! Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

Hi,

I’ve read in https://isacala.org/wp-content/uploads/2020/08/Cortex-XDR-Whitepaper_Coalfire.pdf that the PCI-DSS compliance with 10.5.5 and 11.5 can be achieved with BIOC rules. Unfortunately, there is no details. Has anybody done this and can s

...

Resolved! Security Setting - allowed sessions via approved domains

How does the security feature Allowed Sessions works via approved domains? Does it just reverse lookup the source IP?

BR
Dennis

Shell script for removing Cortex XDR from multiple MacBooks

So, as the subject suggests, my colleagues and I are working on a method to uninstall the Cortex XDR agent from of number of computers (Macs). We do utilize the JAMF MDM here and hence why we are working on a script, however I cannot help but to thin

...

Resolved! Vulnerability Management Cortex XDR (first detection date/time)

Hello,

I want to make some reporting and dashboard with the data provided from the agent vulnerabilty Scan.

I would like to obtain the following informations:

How long has a CVE been present on a machine?
How much time elapses between the appearance o

...

Does xdr_data log failed DNS queries?

Hi team

We are trying to see if XDR agent logged any failed DNS queries... Basically a DNS query made on non-existing domain names.

Can't seem to be able to pull this info out.

Thanks

Disabling CSP Login for Non-Admin Accounts in Cortex XDR with Azure SSO

Hello,

I have successfully implemented Single Sign-On (SSO) for Cortex XDR using Azure SSO. Now, I am looking to disable the Customer Support Portal (CSP) login for non-admin accounts. The goal is to ensure that only admin users have the ability to a

...

Disabling CSP Login for Non-Admin Accounts in Cortex XDR with Azure SSO

Hello, I have successfully implemented Single Sign-On (SSO) for Cortex XDR using Azure SSO. Now, I am looking to disable the Customer Support Portal (CSP) login for non-admin accounts. The goal is to ensure that only admin users have the ability to a

...

CrowdStrike to Palo Alto XDR migration guide/tool ?

I think that now is the time Palo Alto to release CrowdStrike to XDR migration guide or/and tool.

Uninstall application from user profile via live terminal

Does anyone know how to uninstall an application from a users profile via live terminal on cortex XDR. The user has a windows 10 enterprise computer but its installed on their profile. I am trying to uninstall a software called "Screen Share" (publis

...

Resolved! Cortex XDR Agent Proxy Specifications

Is authentication bypass required or not required when user authentication is performed?

Directory Sync usage

Hello everyone,

Just curious who uses the Directory Sync tool out there? If you use it would you mind sharing a quick like/dislike about it? I really want to incorporate it into our environment but not entirely sold on it... yet. Any feedback about it

...

Resolved! Best way to detect endpoints that do not yet have Cortex XDR Agent installed

Hey guys,

I am curious about if there is a way to find out which Endpoints in certain environment do not yet have XDR Agent installed.

I still two options, but had no practical experience in testing it:

1. Directory Sync with Cortex XDR. Would it dete

...

Palo Alto Cortex XDR integration with LogRhythm

Hello,
our customer request to integrate Cortex XDR to LogRhythm, but I couldn't find which port number used to onboard the logsource from Cortex XDR side. Any info?

New to Cortex - Whitelisting files/paths, are they needed

I am looking for definitive answers on whether or not exe files should be whitelisted and where they should be whitelisted within Cortex?

Resolved! automation for retrieve alerts

Hi,

I would like to know if it is possible #Cortex XDR automatically perform "retrieve alert data" and/or "retrieve TSF" for all incidents or alert (critical and high).

I'm asking this because I work with non-persistent VDIs, and many times the user

...

Discussions

Welcome to the Cortex XDR Discussions!

Rules and Best Practices

Resolved! Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

Resolved! Security Setting - allowed sessions via approved domains

Shell script for removing Cortex XDR from multiple MacBooks

Resolved! Vulnerability Management Cortex XDR (first detection date/time)

Does xdr_data log failed DNS queries?

Disabling CSP Login for Non-Admin Accounts in Cortex XDR with Azure SSO

Disabling CSP Login for Non-Admin Accounts in Cortex XDR with Azure SSO

CrowdStrike to Palo Alto XDR migration guide/tool ?

Uninstall application from user profile via live terminal

Resolved! Cortex XDR Agent Proxy Specifications

Directory Sync usage

Resolved! Best way to detect endpoints that do not yet have Cortex XDR Agent installed

Palo Alto Cortex XDR integration with LogRhythm

New to Cortex - Whitelisting files/paths, are they needed

Resolved! automation for retrieve alerts

XQL query for incident report

API Key Required Permissions for Set a User Role

Require help in XQL Query

CONTERX XDR Agent Brute-Force attack and NMAP scan detection.

Cortex XDR on Windows blocks Ansible

Re: Growth of ARM processors in Windows Ecosystem

Re: Increasing severity for certain critical hosts or visible tagging

Re: XQL: How to find events from multiple host

Re: afficher un message via un script python sur les endpoints isolés

Re: Impossible uninstall Cortex XDR

Unlock your full community experience!

Rules and Best Practices

Resolved! Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

Resolved! Security Setting - allowed sessions via approved domains

Resolved! Vulnerability Management Cortex XDR (first detection date/time)

Resolved! Cortex XDR Agent Proxy Specifications

Resolved! Best way to detect endpoints that do not yet have Cortex XDR Agent installed

Resolved! automation for retrieve alerts