Resolved! Automatic retrive alert data on VDI XDR

Hello,
In my company, we have many non-persistent VDIs, and sometimes an alert arises and I couldn't perform the 'Retrieve alert data' because when i see alert the user has already logged out of the VDI.

My question is, is it possible in the Cortex X

Resolved! Suspicious Executable Detected

We have had a number of users endpoints alert with the following:

Subsequent scans of endpoints found nothing and there are not associated incidents within the portal.

As can be seen, there is no identified application name or publisher. Is there an

Resolved! XQL Query to look for a certain username on the domain on what devices they logged on to.

I have other tools that I can scan our entire network looking, but its time consuming to setup and run. This need has come up before., when creds are being used suspiciously and we want to see where all they are logging on.

I think running a XQL may

Resolved! Cortex XDR solution for WSL running on Windows

I am aware that Cortex XDR Agent can monitor traffic leaving WSL in the same way that it does with VMWARE or other virtualisation platforms with the WSL processes being a source of activity onto the windows system which is monitored, but the internal

Resolved! Rule to detect change in file extensions over a given period in a single system

Hi,

We want to write a logic to detect if there have been X number of file renames in Y time for a particular system

Please let me know what is the way to achieve the same ?

Resolved! Is it possible to limit CPU and memory consumption of the Cortex agent?

Hello everybody.
If you have any doubts about the community's help story, my Cortex agent is installed on my Windows servers but often consumes a lot of CPU and memory resources from my VMs, this ends up creating many alerts in my monitoring, I would

Resolved! XQL query to get the list of new software/applications

Looking for help. I would like to come up with the query to find all new applications installed compare to the last month inventory. 

The logic would be what new application/software have been installed on the hosts this month.