Resolved! Automation rule to add IP address to EDL

Is it possible to create an automation script or rule to add a remote IP address to an EDL in Cortex XDR?  I'm exploring the best way to handle this.  For example, after the recent CVE-2024-3400 disclosure, I patched my firewalls, and all is good.  H

Resolved! AD Cloud Identity Sync - computer description

Hi,

I synchronise our on perm Active Directory to the Cortex XDR and this is working well. I'm creating some reports using XQL quires based on pan_dss_raw dataset. My only problem with this, that in the Schema I can't find computer's "Description" wh

Resolved! BIOC API access

Hello Folks,

In the Cortex API documentation there is not mention of how to make BIOC rules using APIs or how to access them.

I was wondering if anyone has been able to use the API to create BIOC rules.

Resolved! XQL query checking BitLocker status

Hi,

I can see BitLocker status in Dashboard -> Endpoint -> Disk Encryption Visibility, but when I try to do the same with XQL query, I wasn't able to find Columns Status in any of preset or dataset. Can somebody help me with this please? I would like

Resolved! XQL query search for "Connection Lost" computers

Hi,

I'm trying to find a query which will show me computers with status "Connection Lost".

Sadly I'm not able to do this in both preset = host_inventory  (can't find the computer which has this status in the Cortex Dashboard) as well as dataset =

Resolved! XQL query help event id

Looking for xql query to find folder name change or folder move event id on particular server.

Resolved! Missing XQL preset queries

Hello we are trying to follow the threat hunting guide for cve-2024-3400. We are trying to use the query:

```

dataset = panw_ngfw_url_raw
| filter url_domain ~= ".*nhdata.s3-us-west-2.amazonaws.com"
| fields _time, log_source_name, action, app, url_dom

Resolved! Exclusion/Suppression rule Reg

Hi

As per my understanding Suppression rule can be created for IOC/BIOC

And exclusion can be created for rest other sources

Is there a possibility to write a rule so that alerts will be generated but they wont contribute towards an incident ?

If it