Denied URL - Broker VM

Hi team!

Does anyone have or have had a situation where the applet local agent settings show "Denied url: URL_HERE"? 

 Sometimes for short periods of time (around 5 -30 seconds) our broker VMs turn on in red the applet and we can see the message

All Actions query failed

When querying All Actions and viewing events for a single PC, a Query Failed error occurs.

Has anyone encountered a similar issue or has any related experience to share?

Hostfirewall Status Report

Hi Team,

I am trying to fetch some report from Cortex XDR console. I would like to know how many endpoints has host firewall rule applied. How many endpoints still running with Windows firewall. Is there any script available to check.

Causality Chain

Hello,

Can you please explain the difference between the causality chain of the 2 attached photos?
What exactly are the executions?

Cortex XDR automation

is there any way to make the automation rule priority one? i don't have any other  rule 

XDR as "SIEM" (challenge for discussion)

I wanted to leave a challenge here for discussion in the group.

Why not use XDR as if it were a SIEM, in order to analyze more events with better accuracy, and to create more correlation and data enrichment?

I’m referring to an environment with:
XDR, X

Process injection into lsass

We received an alert indicating creation of a remote thread in the lsass process by the Cortex XDR agent (cyserver.exe).

I noticed that during the same time period, there were a few other processes that got injected by the agent (e.g. explorer, svcho

Cortex Data Lake - Windows 11 Build & Enablement(?) Info

Windows 11 (and 10 presumably) has a series of numbers which, together, identify the build and patch level of the OS.  This would be a combination of Version: Windows 11 and/or Build Number: 10.0.22631.  The Patch Level (or Enablement Level) is shown

How to delete Endpoints that have old agent and could not be uninstalled

Hello,

I have 2 endpoints with old version:

- 7.3.0.16740 on a server

- 8.6.0.3704 on a computer

I could not upgrade them and have no more access to those computers (in another country).

I asked admin to uninstall, he did not.

How to remove link betw

Cortex Endpoint Isolation - Allowing Microsoft Intune

Anyone have tips on figuring out how to allow exceptions to successfully communication over the internet while an endpoint is in isolation? I would like Microsoft Intune to be able to continue to reach the device while the device is in isolation for

Parsing Rule - SonicWall NGFW

Your mileage may vary. Here's what I came up with 

Yellow Dot

What does the yellow dot mean? I see it in the Artifacts area and in the Assets portion.