Resolved! Broker VM migration

Hi All,

We are planning to do the following for the migration, can you pls validate if this is gonna work or not- 

- We will import the configuration to new broker
- This will shutdown the old broker
- Since we have 2 BVM , we should not have any conn

Resolved! SQL Server Best Practices

Hello.

I am looking for configuration best practices for agent config, exclusions/exceptions for MS SQL. I am new to XDR but I know in similar products it's normal to exclude the database files from live scanning, etc and I can't seem to find any doc

Resolved! Combine dataset of File Path XDR-dataset and PANNGFW

Hi Expert ,

I would like to know how to combine or join dataset between XDR-data and PANNGFW  I make xql of PANNGFW  when found, alert wildfire or antivirus will show file-sha256 by the way I want to combine dataset of xdr-agent to find file-path t

Resolved! XQL converting Bytes to MB or GB

Hey! 

I was just wondering if anyone knows of a way to get the total download/upload to show in MB or GB rather than bytes through an XQL queries' output?

XQL Query

dataset = xdr_data // Using the xdr dataset
| filter event_type = ENUM.NETWORK // Filt

Resolved! Integrating Broker VM with IBM QRadar

Hi Everyone.

I want to integrate Broker VM server with the QRadar using syslog service (we are open to discussion about syslog). 

We have some servers that can't see the internet, so we set up Broker VM and installed agents on the servers. Now we

Resolved! Is there a possibility to create an IOC list to employ it in a query?

Hello Everyone,

I'm new to Cortex XDR and looking to enhance our IOC hunting process. I want to run a scan with IOCs from our subscribed external threat feed.

I have uploaded multiple IOCs to XDR via add IOC option but only able to run the query for

Resolved! Periodic Endpoint scanning on users directory

Is there a way to only scan the users directory? Adding folders in allow list c:\Users\* does not work and scans everything on the device. How can I accomplish this task by only scan the users directory and not scan the entire system?