unable to alert on Device Control Violations

support says it is by design

the "Traps Logs Formats" kb makes no reference to them either

before I go through the headache of sending cortex logs to something for alerts can anyone confirm that they will even be present?

anyone have any other ideas on

Separate Multivalued fields in XQL

Hi Guys,

I need some help.

I have two fields with multiple values and I need to separate there values into separates lines.

My fields are like these:

My goal is to have 1 line with each of the results:

field = value

I tried using the arrayexpa

Reconnect disconnected XDR Clients remotely an easy way

Hello,

We had an issue of some computers getting disconnected status in XDR. In Lansweeper the status of  XDR was disabled. After a long discussion with local support we came out with a nice procedure that allows to reconnect those client without rein

Cortex XDR Collector Installations query

Cryptominers Protection - 2736470759 - Cortex XDR

Hi guys

We have seen a lot of false positives coming from this rule. I was wondering if you would have any guidance on how we could apply exclusion for this type of behavior? 

Thank you!

Cortex XDR Scheduled scans

1) My organization has weekly scans scheduled for Tuesday mornings at 10:00am: How do I view or change the schedule for these scans? And is there a best practice for an ideal time to schedule scans for the endpoints? We currently only get about 50% o

Using SP or IDP for cortex XDR with Azure AD

Hello Folks

Is it possible to use Azure AD to sign in to Cortex XDR and manage user access from Azure AD itself rather than creating accounts in the Cortex XDR individually for a large number of users?

Thanks

Cannot upgrade The Cortex XDR from 7.9.1.26645 to 8.1.1.43337

The error message is that Cortex XDR requires Azure Code Signing support. See Microsoft KB5022661 for details. The I navigated to https://support.microsoft.com/en-gb/topic/kb5022661-windows-support-for-the-azure-code-signing-program-4b505a31-fa1e-4ea

cortex XDR Java API available ?

Hello, I will be using Cortex XDR to scan files in my project (Spring based project) while uploading.

I was searching for a JAVA API which can be used to call Cortex XDR endpoints but couldnt find anything.

Does any one has idea about same ?

Analytics BIOC Rules Incidents

Hello,
By checking a specific Analytics BIOC Rule, I see that it has created several alerts in the past. Some of these alerts have been associated to an incident id. These incidents contain only that specific alert and no insights.

Why the specific