Cortex Domain controllers exceptions

Hi Team,

We are having replication issues across the domain controllers and Microsoft is suspecting its an issue with Cortex and they want the the below files to be created as an exceptions across all our domain controllers.

To rule out Cortex is

Discovering unprotected devices

Has anyone come up with a reliable method to report on devices without xdr running on it? 

Join two data sets XQL

Before I get into my failed script, please allow me to explain what Im attempting to do.

We are looking for windows and Macintosh devices with cortex xdr agent NOT installed.  To do this we installed the cortex DHCP log collector. It is reporting its

Modifying Policies and Profiles on XDR

Dear All,

I wanted to create an XQL Query to identify the modification of XDR policies or Profiles by anyone who have access to XDR, so that I wanted to get the list of users who tried to modify the policies or profiles.

I wanted to convert the X

Auto Agent Upgrade in 3.6 version

Hello Team,

Since the new version of Cortex has come out 3.6 version. 

Wanted to get clarity on auto -the agent upgradation part.

Is it recommended to upgrade your agents(servers/workstation) to N-1 or latest version via auto agent upgrade policy?'

File search based on Host

Is there any option in Cortex XDR, where we can check which all hosts have a specific exe present? 

For eg We want to get a list of hosts which has google chrome installed in it.

Regards,

Shashank

Linux operation mode (Pending)

Dear All,

I wanted to create a widget to display the details of Linux Operation Mode, can someone help me how I can start with, I am still a rookie in XQL Query.

TIA

Agent Blocking files/processes dynamically based on conditions

Hello XDR Enthusiasts,

I am working with multiple XDR Tenants and would like to block a file/process based on conditions. I understand that you can use the Prevention features to block files based on a block/black list. This can also be configured on

Detect critical assets without agent

Hi,

I need to create an alert everytime asset with tag critical has no xdr agent installed, it is outdated, disabled or disconected.

Regards,

Fábio

Outlook stops syncing with Cortex XDR enabled

We have 2 Cortex tenants with a total of about 600 users. We encountered an issue where Outlook 365 will show "Needs password" and will not connect to Office 365 to sync. The only way to get it to sync is to stop the Cortex service. Once Outlook conn