Cortex XDR Discussions

How to create exception/Exclusions for BIOC analytics and XDR analytics alerts

Hello Team ,

We are getting multiple alerts for BIOC analytics and XDR analytics right now as checked on console there is no option visible to add exception/exclusion for this alert.

Can some one please guide how we can create a exception/exclusi

Unable to install Cortex XDR agents 8.1.x or later on Windows 10 Pro Computers

Hello peers,

I tried installing Cortex XDR agent v8.1.x earlier and v8.2.x recently - the Setup Wizard ends prematurely because of some error not presented in detail.

Alternatively, I could install previous version and further upgrade to latest.

Using Cortex with DeTTeCT and dettectinator

I am using the DeTTeCT approach to assessing our coverage against ATT&CK: GitHub - rabobank-cdc/DeTTECT: Detect Tactics, Techniques & Combat Threats. In this approach, you need to start with a set of yaml files that have your datasources and detectio

Correlation rule for detecting Account Created /deleted or Group created /deleted from AD server

Hi Community,

I am looking for correlation rule where in i can detect Account Created /deleted or Group created /deleted from AD server log source.

Scan status details of Cortex XDR

Hi Team, 

Can I get more information on scan status for below scenarios.

. If the scan initiated and before completion the endpoint got disconnected what will be the status?

.. when the endpoint connects back, whether the scan automatically resum

Block all internet-facing queries for a specific application in host level firewall for a specific host.

Hi family, 

I want to block internet-facing queries for a specific application ( 3Ds max.exe). But there is an option on host firewall for all endpoints. How can configured host firewall rules groups for specific on that endpoint not for all.

Thanks,

Cortex XDR Auto Quarantine

Hey all,

Does anyone have experience with turning auto quarantine on?

I don't see much documentation on it but I'm assuming its as simple as quarantining the files associated with Wildfire verdicts.

We're looking to set up recurring malware scans

Block versus Quarantine Malware Module Settings

Is there a greater benefit to enabling the Quarantine setting versus the Block setting across the different modules in the Cortex XDR Malware profile? It is my understanding that both/either will result in the expected protective action (i.e. a poten

Possible threat detected in chrome browser (network.mojom.NetworkService)

Hello Community

Through Query Center, strange traffic behavior towards different IPs will be detected (Through a third-party firewall, computers trying to reach those IP addresses are quarantined)

Generating a query to find out which computers are