Show results only with matching fields from two different queries

I am trying to combine the results from two queries, one using dataset=xdr_data and one from preset=xdr_file. But, I only want to see the results when the same "agent_hostname" appears in both queries. In other words IF agent_hostname from filtered x

XDR AV Scan Alerts/Incidents

Hello Team,

During AV scan, everytime we are recieving cache file is detected from the different hosts and filename and Hash is same. The file verdict is Benign.

Help me how can I address this file. As it is a temporary file.

Your Cortex Data Lake integration with Cortex XDR is about to expire

We received a Cortex XDR email with the message:

"Your Cortex Data Lake integration with Cortex XDR is about to expire. To avoid any data loss, it is recommended that you copy your device configurations directly into Cortex XDR"

There was also a si

Cortex XDR Error Pop-Up in Mac

Hello Team,

We have already granted full disk permissions in macOS for Cortex XDR. However, we are still encountering the following popup:

The popup continues to reappear on the machine.

Not able to define new uninstall password

Our XDR agent uninstall password suddenly became unusable. So i figured i would go in and set a new one. Turns out it won't allow me to set a new password. It says: "Does not meet the requirements".

I have set the password to be 20 charachters, i hav

Cortex XDR Error Pop-Up in Mac

Hi Team,

We have already granted full disk permissions in macOS for Cortex XDR. However, we are still encountering the following popup:

The popup continues to reappear on the machine.

Dashboard creation for device temporary exceptions

I'm trying to create a dashboard with all temporary exceptions, but I can't find the database where the "Device Temporary Exceptions" is located.

Can someone help me

Mac offline scan

We have a mac that we suspect may be compromised.  We would like to run a scan with the device offline and not connected to our network.

How would we go about doing this?

Unable to update cortex to latest version

When i try to update the cortex version 8.1.1.43337 version, I got the attached error. I try to update from 7.9.1 version. 

XDR agent on ... failed to communicate to the server via proxy

Hello,

I am a bit confused by the information in logs when an XDR enpoint is connected to a BrokerVM.

It appears that for some connexions issues, endpoints are not communicating anymore with the BrokerVM:

XDR agent on ... failed to communicate to