Changing Analytics and BIOC Analytics Rules Severity and Configuring the Agent to Block

Hello all,

I have identified that the Analytics and BIOC Analytics is identifying real threats yet no action has been initiated due to the log source. Is it possible to increase the severity of these rules to Medium and higher ? 

Secondy, is it possi

XQL - what am I doing wrong?

Hello dear community!

I am testing some XQLs from the last webinar. 

In my test I fired following XQLs one on one, but I do not understand why the left join doesn't work. I allways get 7 results with the host inventory users preset. Without I get 1

GootLoader and XDR protection

Our customer is requesting to see if the Cortex XDR protects against the GootLoader vulnerability.  Anyone have any idea?

Documentation for Advanced API Monitoring

Dear LIVE community,

Does anyone have any details on Advanced API monitoring? (Under Malware profile --> Global Behavioral Threat Protection Rules)

It is disabled by default and the only information we got so far was that it could help detect CVE-2

XQLs for powershell script logging?

Hello dear community, 

has anyone of you some usefull powershell script block XQLs for event logs to share them with us?

BR

Rob

Blocking Bluetooth From Cortex

Hello Everyone.

How can I block Bluetooth from all the endpoints using cortex xdr? Is it possible?

Thanks.

Disable feature Initiate Live Terminal

Hi Support Teams,

I would like to know how to disable feature Initiate Live Terminal ? because some customer they have concern security control in this feature. 

Regards,

Ongoing Failure in Correlation Rules? View --> No Failure Reasons found

Hello dear Community, 

does anyone of know, how to check what kind of error this was? My correlation Rules are not showing any error/failure Reason

No management and agent log entry. This error is invisible for us!

BR

Rob

Scheduled report for cortex XDR user details

Hello Team,

Can you help us with the query to schedule a report for the user details in cortex XDR.

using XDR to block older versions of an application

I'm attempting to use XDR to block older versions of an application, and only allow the few latest releases. There are hundreds of older versions of this application so blocking each one by hash is not really an option. Also the application's install