Resolved! Malware Scan Results Vs Alerts Created

Hi,

I'm just wondering if someone can help me understand, why  the results of a malware scan (i.e. 19 malicious files found) doesn't reflect the amount of alerts created. I'd assume there would be 19 malicious files as stated, with an alert for each?

Resolved! Clicking "Exclude Alert" in an incident does... what, exactly?

Greetings to everyone.  I have an incident with several alerts.  While looking at the incident closely, the "Exclude Alert" and "Investigate Causality Chain flyout appeared, and I unintentionally clicked on "Exclude Alert".

According to the logs, I

Resolved! Visibility of Fortinet Alerts when ingested in Cortex XDR

Hello,

I started to ingest my Fortinet logs and alerts in Cortex XDR to get a better visibility and Analytical Alerts in the XDR.

Whereas, I observed that the visibility and the readibility of the Fortinet Alert in the Cortex XDR console look weird

Resolved! How stable is Cortex agent 8.2

Hello,

My client company is gonna update their Cortex agent from 8.0. I am trying to assess the risk/  benefit of moving straight away to 8.2 instead of updating to 8.1 first.
The benefits are clear :
Having the more recent version and more time without

Resolved! How to Perform Access to File Triage in Cortex XDR

Refers to https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-Triage-Configuration

i cant find menu Forensic or Triage in my Cortex XDR to Access File Triage in Cortex XDR, anyone can help or give a recco

Resolved! How to Powershell malicious check

Hi, im need to Powershell malicious check i Cortex XDR with  Instance Administrator console role, how can i do?

Resolved! Creating BIOC Rule for Large FTP Sessions

Hi Everyone,

I'm new to Cortex XDR and looking to enhance our network security alerts. I want to create a BIOC rule that triggers an alert whenever a data transfer larger than 100MB occurs between two devices (Local IP to Remote IP). This will help u

Resolved! Cortex XDR Agent configure in dhcp server query

Resolved! Is it possible to trigger insights collection on multiple hosts?

Hi,

I know that I can go to Endpoint Data -> Open Asset View -> Open Asset View in new tab and then use "Run Insight collection" but from time to time I need to do this on around 50 hosts so this option is not really practical. I wasn't able to find

Resolved! Deleting files in path /opt/traps/download/content

Hi,

Does anyone know if what is stored in this Cortex XDR agent path /opt/traps/download/content can be deleted?

Cortex XDR