Cortex XDR Pro - Forensics Addon - WEC

Hello dear community, 

If we choose to gather forensic artefacts from a WEC, which event logs will be forwarded? Only the one of the machine or all the collected logs from the forwarders?

BR

Rob

Kandji MDM

Hello everyone,

Over the last two months we are having constant issues with Cortex and Kandji playing nice together. Before that everything was working without any issue for at least half a year, if not longer.

What happens is the following: Kandji g

Question about XQL to make a BIOC

Hello,

I'm trying to make a BIOC to inform when a SSH conection is made in some critical assets, but I'm not able to do it in XQL, I have done it using the interface.

Network Connections AND Destination [ Remote port = 22 ] AND Host [ Host Name =

Ability to see Programming langauage version of deployed applications

I have a need :To audit which "applications" are approaching end of life based on their "programming language runtime version"

Does Cortex XDR provide a way to get an "inventory of all applications" with their "programming language runtime versio

New Pen Drive Plugged in Detected

Can I create a rule to generate an event for detecting USB Plugged?? Is there any method to detect USB Plugged in event using cortex?? If so how??

Its possibele to see which are the endpoint accesing usb

By default, we block USB access. However, if there's a specific need, we grant access. Is there a way to monitor if an endpoint is attempting to access USB without authorization?

Cortex XDR new image for the Broker VM

Need (XQL) BIOC Rule for starting CMD/Powershell through LNK Files

Hello dear Community, 

as you know a very common attack is loading code directly to memory. This happens sometimes through a LNK File or Office Macros. 

In my case I want to hunt for LNK Files, which were doubleclicked and a cmd or powershell was s

Does WDAC work side by side Cortex XDR Pro on a fat client?

Hello dear community, 

as I know microsoft defender is deactivated by Cortex XDR Pro. 

Do you know, if it is possible to use WDAC side by side with Cortex XDR Pro? Is there a relationship between deactivated defender and wdac?

BR

Rob

Is there a command line to disable shutdown and reboot on MacOS ? It's kind a urgent.. Can you share your thoughts on this issue please ?

Is there a comparable command to turn shutdown and reboot off?

XDR agent potentially prevent Performance Monitoring from being run

Hi

Our client has been having issues running Windows Performance Monitoring tool - which may be caused by an XDR agent.

This issue sort of happened out of nowhere but there was this one behaviour which suggested the XDR agent may be a culprit. Th