Cortex XDR 3.10 and endpoint slowness

3.10 activated in our tenant yesterday and along with that, our endpoints started upgrading to 8.3 (we are one release behind the latest).

This morning we were deluged with calls about unresponsive endpoints.

We stopped the automatic endpoint upgra

XQL Question - Aggregation by field of type array is unsupported

I'm trying to run a query to get a count of how many times combinations of the values in "initiated_by" and "initiator_path" occur for an alert in the alerts dataset.

For example:

binary1.exe  c:\temp\blah 6
binary2.exe c:\temp\blahblah 12

I'm trying to

Whitelist our backup software

Hello,
I do represent a company called Arx One. We have been publishing a backup software suite (backup agent, agent management console) for more than 15 years now and those software are installed on our customers' workstations, servers or NAS (Window

Failed to load license data

Since our recent renewal, which is reflected in Assets in the support portal, attempting to Cortex XDR results in an error message of "Failed to load license data or license is expired."

Background: We recently renewed our Cortex XDR Pro license. W

XQL Query - Union between Alerts and Incident datasets

Hi

I want to write an XQL query wherein i will be able to get both details of incident and Alerts in one table.

I want to correlate Incident ID and Description with the tables found in Alert dataset like CGO, Initiated by, Action process etc

XDR USB Activities

Hello, 

I have a few questions and I would be happy If you answer them. 

Questions:

1. In device control tab of Cortex XDR, I  can easily turn DIsk Drives to read mode. It is okey and working when I am doing this. I cannot delete any file, write or

XQL quey help

Hello everyone, 

I would like to replicate some queries in Cortex using XQL, but I have many doubts with this language and I am arguing with it 

Example:

T1140 Deobfuscate/Decode Files or Information 

Host insights enabled, yet only 12% have any CVE information. How to troubleshoot?

We've been running XDR Pro per endpoint since late 2022 with the host insights add-on licensed and enabled for all endpoints.
CVE data exists for around 12% of the endpoints and include every OS, etc... no rhyme or reason why some work, but most do no