XDR Agent Stop 8.3.0

Hi, I would like to know if anyone has experienced this problem. Sometimes, without any apparent reason, the Cortex XDR Agent version 8.3.0 stops responding on Windows Server 2016 servers. When we check the services, the service is stopped

We restart

Panorama integration

Hello,

Have anybody integrate with Panorma? There is an option to do so under the NGFW integration:

How exactly does it work? 

I have integrated XDR with NGFW and everything works fine, logs are collected, but I am wondering what is the use case t

Agent 8.3.2 not showing in the Agent list in the Instance

Hi Team,

As shown in the "Cortex XDR Agent Release" official document that 8.3.2 has been released on June 24th 2024, but we are not getting that agent version in our instance "Agent Installations". 

Cortex XDR is unable to block USB viruses - the reason is unknown.

We recently encountered an issue where a user's computer got infected with a USB virus after inserting a USB drive. The virus uses USB Driver.exe to create some directories and malicious programs as shown in the attached image. Additionally, it uses

Virtual functions/Variables - Creating anomaly based detection rules - XQL

Hello Everyone,

Cortex XDR has the functionality does allows you to use XQL queries to create lookups or datasets.

The problem is that these are static and cannot be dynamically updated for detection rules.

The use case I had in mind is that I have

Agent Audit Log "Start" event

Hi,

I cannot find a single "Start" event under my Agent Audit Logs. If I can see there is a "Start" if I use "Sub-Type" as a filter so I suppose there must be "Start" event. Does anyone have idea?

Cortex XDR Agent Scripts Library

Hi Community,

I have a query. I am interested in retrieving the user access history for a specific URL in the browser for the last 3 months. Is it possible to run a Python script to retrieve this information?

XQL query for searching extensions installed within an application

Hi All,

Looking for an XQL query to detect extensions installed from an applications marketplace to use within the application. For eg. someone installing "github actions" extension from the azure marketplace.

Huge Cortex XDR upload traffic observed from firewall

We have branch network connected to Data center via MPLS VPN link. All branch PCs internet traffic going out from the DC firewall. From all the branch PCs (Around 8000), we have observed a huge outbound traffic towards internet related to Cortex XDR