Configuring alerts in Cortex XDR to prevent incident generation

Hello,

I want to configure certain NGFW alerts in Cortex XDR so that they no longer generate incidents based on criteria such as the alert name, source zone, and destination zone. I do not want to completely hide the alert with an "Alert Exclusion"

Broker VM, local agent setting status indicator fluctuates between Green to Red

Hello,

Greetings

Can anyone confirm why does status indicator of Broker VM's Local agent setting keeps fluctuating. It keeps changing between "Connected to Connection Failed" also showing inaccessible URLS that are already whitelisted. Also the a

Device Permanent Exceptions - Is There A Limit?

Hello-
Is there a limit to the number of devices that can be listed within the Permanent Exceptions?  Endpoints -> Policy Management -> Extensions -> Device Permanent Exceptions

Thanks.

Cortex XDR - Solutions for log collection without an official integration

Has anyone found a good approach for collecting logs from an API when there isn't an official Cortex XDR integration?  For example, Automox has released a Splunk and DataDog app, but the custom collection in Cortex XDR isn't a good fit.  We use the B

How to configure for assessed the Suspicious Process on Cortex XDR that need to monitor and logged because customer don’t need to exclusion?

Hi Members,

     Please advise. How to configure for assessed the Suspicious Process on Cortex XDR that need to monitor and logged because customer don’t need to exclusion?

Thanks & regards,

Jirapan M.

AWS CloudFormation preset template for Cortex XDR

Hi Cortex XDR community,

We are trying to set up Cortex XDR to ingest cloud assets from AWS. It mentioned that aws clouldformation stack needs to be created using preset Cortext XDR template. Where this template can be found? Is there a link to dow

Compare results in table to lookup?

I have a lookup with software names and want to use it to compare it to results from xdr_data using the fields actor_process_image_path which is the dir the software in installed in.  

HELP With XQL Query to fetch All Assets

Hello Everyone, 
I want to fetch all assets from asset inventory using XQL query but I am unable to find a suitable dataset for it. Can someone please help with XQL Query to fetch all the assets. 

Thank you 

Cortex XDR 

no alerts no incident

Hi everyone, i have an issue. Cortex receives data from data sources (endpoints, servers etc) but i can not see alerts and incidents. My dashbord shows 0 alert and 0 incident. Who could help to me?