XQL Query to list top process causing issues

Dear All,

I would like to know how to build a query to troubleshoot issues on a host where I wanted to list the processes running on the host and also to identify which is causing the issue. I am writing the below query to find no details, please h

NTA Dashboard

Hello all,

My goal is ingesting the log from my Fortigate for correlation and analyses.

I'm evaluating Pro per TB now, done the configuration already, actually, the log is receiving now.

Found the new NTA Dashboard, however, it showed No Permi

Get-Idea to use api get all endpoint with last seen

Hi Expert ,

I would like to get all endpoint install xdr but would  like to know condition last seen such as more than 1 month I use python 

Thank you

Cortex XDR Vulnerability Assessment - Linux Backporting Security Fixes

Dear community

When using the Vulnerability Assessment with Linux hosts, the results may include a lot of false positives.

Distributions which are backporting security fixes (CentOS / Debian) do may not change the App Version when they got patched.

htt

Compile Payload Source Code Locally

Dear Team,

We wanted to restrict compilers on our environment after a pentest resulted with Compile Payload Source Code Locally, we have common compilers like csc.exe and GCC/MinGW. 

We wanted to know how to identify any common suspicious behavio

Forensics on deleted files on Endpoint

need to know if XDR has the capability to perform forensics on Endpoint if user deleted any files on computer.  If so, how would you go about performing this task.

,Download the freshly created xdr-distribution-file

Hello

I'm looking for an autmoatisation, where I'm able to download the freshly created xdr-distribution-file.
In my Playbook I've created following steps:

xdr-get-distribution-versions
xdr-create-distribution
xdr-get-distribution-url

Now, the last step

Some Alert Exclusions don't work anymore

Hello dear community,

Since some days, my alert exclusions do not work anymore and the alerts are popping up. Now i noticed the quotes in the target process cmd.

powershell.exe -command --> before

"powershell.exe" -command --> from now

What has

Cortex XDR Pathfinder

I dont really understand logic behind PATHFINDER. I installed Broker VM and configured pathfinder. But i can not see anything in Pathfinder Collection Center. I can not find answers to my questions  in documentations. Can anybody please explain about