The Cortex XDR not installed still incident getting generated

We have observed incident on the server in which Cortex XDR is not installed. The system is only present in the asset inventory. How is this possible, on what basis incident is getting generated?

Incident Name: Multiple Rare LOLBIN Process Executions

XDR Capabilities

Does XDR has the capability to identify and block admin access on end user workstation?

Scaning files for malware

Is it possible to use Cortex XDR to analyse malicious Microsoft Office files, such as Word, Excel and PowerPoint documents? If I right click on Office file and choose Scan with Cortex XDR will Cortex check if that file is not used for delivering malw

Legacy Exceptions - Endpoint version compatibility

Hi, everybody,

I plan to accept Legacy Exceptions générated from my profile based policies.

Major part of the endpoints are running [CE] versions, prior to 7.9. All these versions are supported.

Does anyone had problems when activating these Lega

What happens to existing prevention profiles when enabling the "Host Insights" license?

Hello 

Does anybody know what happens to the configuration of existing prevention profiles when the "Host Insights" license is activated? The environment currently has several prevention profiles that have the "XDR Pro Endpoint capabilities" enable

Cortex XDR Generate Alert when Device is Online

There's many situations where it would be convenient to receive a notification when a device is online.  We often run into this when a device is isolated and we are  unable to contact a user.  Since there is no native ability to trigger an alert or n

Automate Isolation Endpoint

Just wondering if there is somewhere in xdr to tell it to isolate an endpoint automatically if we get a critical/high/medium alert or confirmed malware/ransomware alert.

I thought there was something in the profiles to change for active this functi

Deploying Cortex XDR Agent for macOS with VMware Workspace ONE (AirWatch)

In order to deploy the Cortex XDR Agent to macOS you have to have both the Config.xml and Cortex XDR.pkg files bundled in the same deployment file. Workspace ONE does not support the uploading/deployment of a .zip file so you have to use a workaround

Cortex XDR trail version for testing purpose.

We are trying to integrate the Cortex XDR incident logs to Splunk using the API pull method. We customised the Splunk TA taking reference from the Splunk TA for Palo Alto NW.  So is there a trail version of Cortex XDR available in order to test the i