Mitre ATT&CK coverage

Hello dear Livecommunity, 

as you know, Cortex XDR is a very powerful peace of software and I am happy to use and administrate it. 

But I never doubt about coverage of the mitre attack patterns and I am a little bit upset, we need to get through th

Broker VM & SIEM

Hello folks.

How we can forward Cortex Agent logs from Broker VM to SIEM systems?

[agent] ====> [Broker VM] ====> [SIEM]

Cortex XDR 

CORTEX XDR

I want to add palo alto firewalls to cortex xdr do I need to add only panorama or do I need to add 

Indvidual firewalls to get alert 

do i need to use firewall mgmt. ip or panorama mgmt. ip 

we have more than 300 firewalls split into HWAN and LAN MFG

Query regarding malware scan

During initiating the malware scan on connected endpoints suppose the system moves to disconnected state for few days and the scan status starts showing in progress now. Could you please let us know the duration of the malware scan is applicable for

Malware scan is not getting intiated

Hello,

While initiating malware scan through policy, for certain endpoints the scan is not getting initiated, and the scan status is "None". How can this be resolved?

How to check endpoint has no agent and intregate edl with NGFW

Hi Expert ,

How to check endpoint has no agent and integrate edl with NGFW when found endpoint 

Now , I have try to create  python script  to get all endpoint  but not have idea to check endpoint has no agent 

Thank you

Whitelisting of Files

Hello, 

We are running periodic scan on all endpoints . During this scan few files has been detected .We have  got confirmation that some of the files are legitimate and it's being used in infra. 

Can you please suggest in providing what is the best

Block a digital signer?

Does anyone know if there is a way to block a digital signer? Or does anyone have any better ideas for blocking Wave Browser without blocking all of their ever-changing thousands of hashes?

Visualize Running processes through XQL and send alert?

Hello dear community!

is it possible to visualize through XQL a prozess which was not terminated and is still running?

In the causality view it is visualized, but I would need it to create a alert. 

If a special process is still running, get a mail