Cryptominers Protection - 2736470759 - Cortex XDR

Hi guys

We have seen a lot of false positives coming from this rule. I was wondering if you would have any guidance on how we could apply exclusion for this type of behavior? 

Thank you!

Cortex XDR Scheduled scans

1) My organization has weekly scans scheduled for Tuesday mornings at 10:00am: How do I view or change the schedule for these scans? And is there a best practice for an ideal time to schedule scans for the endpoints? We currently only get about 50% o

Using SP or IDP for cortex XDR with Azure AD

Hello Folks

Is it possible to use Azure AD to sign in to Cortex XDR and manage user access from Azure AD itself rather than creating accounts in the Cortex XDR individually for a large number of users?

Thanks

Cannot upgrade The Cortex XDR from 7.9.1.26645 to 8.1.1.43337

The error message is that Cortex XDR requires Azure Code Signing support. See Microsoft KB5022661 for details. The I navigated to https://support.microsoft.com/en-gb/topic/kb5022661-windows-support-for-the-azure-code-signing-program-4b505a31-fa1e-4ea

cortex XDR Java API available ?

Hello, I will be using Cortex XDR to scan files in my project (Spring based project) while uploading.

I was searching for a JAVA API which can be used to call Cortex XDR endpoints but couldnt find anything.

Does any one has idea about same ?

Analytics BIOC Rules Incidents

Hello,
By checking a specific Analytics BIOC Rule, I see that it has created several alerts in the past. Some of these alerts have been associated to an incident id. These incidents contain only that specific alert and no insights.

Why the specific

XDR Alert Exclusion

Hi,

I excluded an alert from an incident.

But i am not able to see that exclusion being created under Settings > Exceptions Configuration > Alert Exclusions.

May i know why?

Kindly help.

@mcooley 

Thanks,

Nithin

XDR Masquerading Incident

From few days getting the alerts under the "Masquerading" alert name. when we analyzed we observed there is a .exe file creation in the sysmon folder with the long string "C:\Sysmon\2BE609177094318EA49602B566942D95E6C81494161F8EC8A3AA6AE26FFCDD14F8F5

Cortex XDR 7.5.3.60113 cannot uninstall

Dear Team,

I have a cortex xdr 7.5.3.60113 cannot uninstall.

all service has been disable. somehow, i uninstall it untill 99%. it will rollback.

Could you please advise how to uninstall it completely or any uninstall cleaner can provide? thank you.

B

Cortex XDR Pro - Forensics Addon - WEC

Hello dear community, 

If we choose to gather forensic artefacts from a WEC, which event logs will be forwarded? Only the one of the machine or all the collected logs from the forwarders?

BR

Rob