Does xdr_data log failed DNS queries?

Hi team

We are trying to see if XDR agent logged any failed DNS queries... Basically a DNS query made on non-existing domain names.

Can't seem to be able to pull this info out.

Thanks

Disabling CSP Login for Non-Admin Accounts in Cortex XDR with Azure SSO

Hello,

I have successfully implemented Single Sign-On (SSO) for Cortex XDR using Azure SSO. Now, I am looking to disable the Customer Support Portal (CSP) login for non-admin accounts. The goal is to ensure that only admin users have the ability to a

Disabling CSP Login for Non-Admin Accounts in Cortex XDR with Azure SSO

Hello, I have successfully implemented Single Sign-On (SSO) for Cortex XDR using Azure SSO. Now, I am looking to disable the Customer Support Portal (CSP) login for non-admin accounts. The goal is to ensure that only admin users have the ability to a

CrowdStrike to Palo Alto XDR migration guide/tool ?

I think that now is the time Palo Alto to release CrowdStrike to XDR migration guide or/and tool.

Uninstall application from user profile via live terminal

Does anyone know how to uninstall an application from a users profile via live terminal on cortex XDR. The user has a windows 10 enterprise computer but its installed on their profile. I am trying to uninstall a software called "Screen Share" (publis

Directory Sync usage

Hello everyone,

Just curious who uses the Directory Sync tool out there? If you use it would you mind sharing a quick like/dislike about it? I really want to incorporate it into our environment but not entirely sold on it... yet. Any feedback about it

Palo Alto Cortex XDR integration with LogRhythm

Hello,
our customer request to integrate Cortex XDR to LogRhythm, but I couldn't find which port number used to onboard the logsource from Cortex XDR side. Any info?

New to Cortex - Whitelisting files/paths, are they needed

I am looking for definitive answers on whether or not exe files should be whitelisted and where they should be whitelisted within Cortex?

Help with Memory corruption exploitation event in excel.exe

Hi, I need your help.
When analyzing a Memory corruption exploitation event in excel.exe, the Cortex XDR usually doesn't provide much information

I can only see in the graphical interface that the user executed Excel at that moment.

In my case, it s

Slack notifications in Cortex XDR Pro

Hey dear community!

How do they look like? Do we have any advantages over the e-mail notifications?

BR

Rob

How to count endpoint ACTUAL ACTIVITY by SQL query

Dears,

"ACTUAL ACTIVITY" graph under user card page in XDR is very amazing feature show the duration of user working hours. 

Unfortunately, the time was not specified with exact minuets. My management asks me a very accurate duration of how many ho

Cortex XDR CE version

How to know if Cortex XDR version is CE.

Will it show on the table when I go to Endpoints ----> All Endpoints and on the Agent Version Field it should have for example 7.9.102CE, if it shows 7.9.102 only then it is a standard version? 

Thank you.