Preventing CrowdStrike disaster in Cortex XDR Pro

Hello dear community!

what could we or PA setup in PA Cortex XDR to prevent us from such a disaster which happened to CrowdStrike?

Are there any settings or recommendations which can be shared? 

BR

Rob

XQL search for DOM hash and cryptocurrency wallet address

Hi all,

Anyone knows how to do XQL search for DOM hash and cryptocurrency wallet address in XDR Query search?

Thanks.

Alert "Script Activity - 245655498"

Hello everyone,

I just received this alert "Script Activity - 245655498" with this description "Suspicious script with keywords written in a non-standard way." in Cortex multiple times related to PowerShell script execution on a developer machine.

Tons of receptivity.io

I recently see a lot of my end machine shitting this domain: receptivity.io

Started (I dunno even know, a week ago?) My logs can no longer go far enough back to figure it out.

Cause I dunno, MS edge new tab? To hopefully remove the log entries I

XDR Malware scan

Hi All,

We have a middle team that manages the end users and we are planning to give them the process of scanning the endpoints however if an end user initiates a scan we are not getting the event on ACTION CENTRE which makes it difficult to track

Ransomware isolation automation

Hi everyone.

Have XDR Pro. Looking for an "easy" way to automatically isolate a device when ransomware-like behaviors are detected. Looking through the automation configurations, it doesn't appear to be that easy. I obviously don't want to be isolati

Disk space and usage

Hello, 
If Agent settings are configured at the default 5000mb to allot for XDR agent logs.

How many days would this be expected to cover - ie are there any rough figures on low - high usage devices, to get an estimate.
Looking at dataset use I estimat

Cortex XDR Host-Based Firewall

Hi Team,

I have a query regarding Cortex XDR's host firewall. We have enabled the host firewall on one machine in reporting mode for testing purposes. The configuration was successful, and we received host firewall events. We collected the detailed

Incident Reports - any hidden feature to crate an incident report summary?

Ist there any possiblity to create an incident report by just a click?

Something like this:

https://techsevenpartners.com/a-step-by-step-guide-to-creating-a-cyber-security-incident-report/#:~:text=To%20create%20a%20cybersecurity%20incident,%E2%80%9