Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Cortex XDR Query for USB/External Drive Usage

Hi Family Good morning. I am trying to filter the timeframe when a user last connected a USB flash drive or external hard drive using a Cortex XDR query. However, the following query did not return the expected results: dataset = xdr_data | filter event_type = device and event_sub_type = DEVICE_PLUG I would like to retrieve details ...

Issues with Mass Uninstallation of Cortex XDR Agents via SCCM

Cortex XDR sometimes have these stubborn machines that refuse to upgrade to the latest versions. what are ways you use to alleviate this issue? Mine is SCCM.I am trying to automate the mass uninstallation of older versions of Cortex XDR agents via SCCM on hundreds of Windows clients. The issue I’m encountering is related to password handling dur...

query to pull specific hosts for successful logins

Hello, I'm using a canned library query called "Successful Windows Logins" This is a great query but how can I modify it so that its only looking at specific hosts vs all hosts? I can't figure out how to edit this. Can anyone help?

Resolved! XQL chart editor

Hi. just i'm little stuck... config timeframe = 1y|dataset= incidents|filter (status in (ENUM.RESOLVED_FALSE_POSITIVE,RESOLVED_AUTO_RESOLVE))|fields creation_time ,status|alter month = format_timestamp("%m",creation_time )|sort asc month|comp count(status ) as total_auto_resolved_inc_month by month,status| view graph type = column subtype = gr...

Resolved! Post detected by Wildfire

Hello dear community, what means Detected (Post Detected)? In our case, we see pdfpower.exe incidents popping up, the user says he didn't download anything to the incident time. I think, the agent is scanning the OS, when there is allready a quarantaine or blacklist entry? What do you think? BR Rob

How to (temporarily) disable security in Cortex XDR to be able to update the client from outside the Console

Hello team, We need to know how to disable (temporarily) the security in Cortex XDR to be able to update the client from outside the Console. The updates from the console are causing us blue screens and we want to test it using scripts when shutting down the computers (Shutdown policies). Can you tell us how to do it? Regards

How much resource consumed by XDR agent

Hello, Just wondering how much resource (CPU, Memory, Bandwidth) will be consumed on Windows agent normally? what is the bandwidth requirement per 1000 agents? Defference with or without brokervm? Thanks, SdG Cortex XDR

Cortex host insight Vulnerability Assessment average severity score

trying to find XQL query that will take all of our severity scores and give us a average and send that to report. I cant seem find the dataset Not very good with XQL at this time. maybe someone from the community can help dataset = host_inventory | filter 0 is not null and array_length(vulnerabilities) > 0 | alter vulnerability_scores = arra...

XQL query time setting

Hi! I want to make a report that generates every month and it contains the previous month's data. My problem is that i cannot make it to be created on the first day of the month. So I tried to make the XQL query to work with the previous month's data. I got stuck there. Does anybody know how to do it? Thanks Cortex XDR

Temporary Session installation type

We have a large Citrix farm with session hosts and non-persistent servers. We are using the TS_ENABLED=1 switch when installing the agent but the console is showing standard installation and not Temporary session. I am trying to figure out what the Cortex console looks at on the client to tell if it was a temporary session install. Is it a re...

Resolved! Web applications

Is XDR capable to protect web applications and how

File retrieval in user context

Hello, Is it possible to retrieve a file which is only accessible in user's context? I have an incident which user opened a file from a network mapped drive. That drive might not be accessible by anyone except for the user. Which user context is used when we initiate File retrieval via: 1. Cortex console or an agent script 2. Live terminal T...

Resolved! XQL - Time alteration

Hello,Here is the scenario:I have a table lookup looking for a specific event. dataset = xdr_data | filter event_type = SOME EVENT | alter TimeOfIntereset = _time Now I want to join this again with the dataset table to enrich it and perform further analysis based on the time. | join type = inner ( dataset = xdr_data | filter event_type = SOME...

XDR Collector DNS

Does anyone know if there is a native DNS collector, similar to the DHCP Collector Agent, for Cortex XDR ? My goal is to enrich XDR with more DNS-related information.

Mac Cortex XDR Upgrade causing Device Freezing

Hello, My organisation is currently running Cortex XDR 8.6.0 on Sequoia. We're finding that when performing upgrades of the application via the Console or by Jamf that the who device will freeze for 15+ seconds. We're in an environment where we're running both Cortex XDR and Defender (Real Time Protection enabled) and I think it's some sort ...

Discussions

Welcome to the Cortex XDR Discussions!

Cortex XDR Query for USB/External Drive Usage

Issues with Mass Uninstallation of Cortex XDR Agents via SCCM