Cortex XDR Discussions

Resolved! Group By Host in Filtered XQL Query

What I want to do is generate a report showing the filtered list of CVEs on each host, multiple CVEs would show up in a single field concatenated with commas or semi-colons

dataset = va_endpoints
|arrayexpand cves
| filter CVES in (
"CVE-2019-2725", "CV

...

Resolved! Quarantine Retention Period

Hi Team,

If we enable quarantine feature on malware profile, how long the file stay in quarantine location? Is there any retention period?

Annoying Orbs in Dashboard Background

Hi

Does someone know how to disable these annoying and resource hungry things?

The CPU drops from ~30% to below 3% as soon as i disable this in the developer tools:

xdr-animated-orbs _ngcontent-awl-c931

(Tried with Vivaldi and Edge.)

Who would co

...

XQL query display hosts with KB not installed

Hi,

If I want to display hosts with some KBs installed, it is relatively easy as I use following query:

preset = host_inventory_kbs
| filter endpoint_type contains "WORKSTATION" and hotfix_id in ("KB5034763","KB5034122")
| fields  endpoint_name

Probl

...

I can uninstall cortex xdr 8.2 agente in safe mode without password

hi

i'm having penetretion testings, and they can uninstall cortex xdr 8.2 agente in safe mode on windows 10, i have the anti-tampering protection enabled, and a password for uninstall.

I understand that this was imposible in the version 8.2 or later

...

Feasibility Check

Hello,

Kindly help to know the below requirement using Cortex XDR -

Can we disable paint and snipping tool on desktop?
Disable taking screenshot.

Resolved! cortex XDR add SHA1 detection

Does anyone know a way to detect for SHA1 on Cortex XDR?

Regarding IOC, it can't add SHA1 into hash type.

Regarding BIOC, for xdr_data, there is no columns to determine the SHA1 for a file or process:

Any ideas?

I have problem im having trouble setting up Cortex XDR agent. I have installed 7.5.102.21864 [CE] version to my windows 7 machine via proxy and network access is ok. As usually when agent is installed it changes state to enabled by itself. For no

...

Resolved! XQL query for complete beginner

Hello, i'm trying to create an XQL query that will show all alerts, as opposed to incidents. Is that possible?

prophaze waf Log Ingestion in Cortex XDR Management Console

I kindly request how to ingest prophaze waf Logs in the cortex console. If possible, could you guide how to proceed with this integration? Additionally, please share any related documents or resources that could be helpful in this process.
Cortex XD

...

Resolved! Difference between Critical environment and Normal Version

Hello,

Can you help with the difference between Critical environment and Normal Version of Cortex XDR?

When should an organisation use critical environment ?

Regards,

Shashank Sinha

Resolved! USB Use - empty results table rows

Hello,

Currently I am monitoring USB device use within my tenant, with the following query:

config case_sensitive = false
| preset = device_control 
| join (dataset = endpoints ) as EP EP.endpoint_name = agent_hostname
| filter event_sub_type = ENUM

...

Resolved! Reports on automatic scans

Good morning,

We want to schedule automatic scans for some servers, currently we already have a malware profile created that runs these scans. The problem is when it only generates a log that it was done, but no report as such. Is there any way to

...

Please help with, Cortex XDR query to efficiently filter incidents with high and medium severity with artifact.

Hi Family ,

Please provide a Cortex XDR query to efficiently filter incidents with high and medium severity, including artifacts, dates, endpoint names, and IP addresses.

Cortex XDR

regards

We config WEC in broker vm in that we followed every confi but we rea getting below erro

19/01/2024 11:31:34            209 Information      The Winrm service started successfully
19/01/2024 11:31:34            208 Information      The Winrm service is starting
19/01/2024 11:31:33            212 Information      The Winrm service was stopp

...

Discussions