Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

I can uninstall cortex xdr 8.2 agente in safe mode without password

hi i'm having penetretion testings, and they can uninstall cortex xdr 8.2 agente in safe mode on windows 10, i have the anti-tampering protection enabled, and a password for uninstall. I understand that this was imposible in the version 8.2 or later so my question is, why could they do it?

Feasibility Check

Hello, Kindly help to know the below requirement using Cortex XDR - Can we disable paint and snipping tool on desktop? Disable taking screenshot.

Resolved! cortex XDR add SHA1 detection

Does anyone know a way to detect for SHA1 on Cortex XDR? Regarding IOC, it can't add SHA1 into hash type. Regarding BIOC, for xdr_data, there is no columns to determine the SHA1 for a file or process: Any ideas?

Cortex XDR agent problem

Hi, I have problem im having trouble setting up Cortex XDR agent. I have installed 7.5.102.21864 [CE] version to my windows 7 machine via proxy and network access is ok. As usually when agent is installed it changes state to enabled by itself. For now its not changing the status to enabled and i cannot see it on console. When i check firewall i ...

prophaze waf Log Ingestion in Cortex XDR Management Console

I kindly request how to ingest prophaze waf Logs in the cortex console. If possible, could you guide how to proceed with this integration? Additionally, please share any related documents or resources that could be helpful in this process.Cortex XDR Cortex Data Lake Me too

Resolved! Difference between Critical environment and Normal Version

Hello, Can you help with the difference between Critical environment and Normal Version of Cortex XDR? When should an organisation use critical environment ? Regards, Shashank Sinha

Resolved! USB Use - empty results table rows

Hello, Currently I am monitoring USB device use within my tenant, with the following query: config case_sensitive = false | preset = device_control | join (dataset = endpoints ) as EP EP.endpoint_name = agent_hostname | filter event_sub_type = ENUM.MOUNT_DRIVE_MOUNT | dedup agent_hostname | fields _time, agent_hostname, user, agent_ip_addres...

Resolved! Reports on automatic scans

Good morning, We want to schedule automatic scans for some servers, currently we already have a malware profile created that runs these scans. The problem is when it only generates a log that it was done, but no report as such. Is there any way to give us a report of the scan when the automatic scans are scheduled? or it will only generate a r...

Please help with, Cortex XDR query to efficiently filter incidents with high and medium severity with artifact.

Hi Family , Please provide a Cortex XDR query to efficiently filter incidents with high and medium severity, including artifacts, dates, endpoint names, and IP addresses.Cortex XDR regards

We config WEC in broker vm in that we followed every confi but we rea getting below erro

19/01/2024 11:31:34 209 Information The Winrm service started successfully19/01/2024 11:31:34 208 Information The Winrm service is starting19/01/2024 11:31:33 212 Information The Winrm service was stopped successfully19/01/2024 11:31:33 211 Information The Winrm service is stopping1...

Resolved! Filter by IP address range

Hello there, I've definied multiple IP address ranges in the assets module of Cortex XDR console. Some range belongs to the same factory. Ranges have a name like this : FactoryName - VlanName We have multiple units. Somes units contains multiple factories. I would like to create dynamics endpoints group (for units) filtered on the IP addre...

Data Ingestion License Violation

After our Cortex XDR tenant was upgraded to 3.9 we started receiving the following error: "License Violation warning Based on a 7 day average calculation from February 24th 2024 to March 1st 2024, your daily ingestion quota is exceeded." Looking at the Data Ingestion Dashboard it appears our NGFW data ingestion is reporting to has significantl...

Mobile iOS install with InTune

Hey everyone, Is there a way to bypass the onboarding wizard screens that you see when setting up the app and just configure it with Intune? If not, we'll have to manually walk through these settings on potentially thousands of devices.

Create a ".bat" file for installing XDR on Windows machines

Dear Team, The customer is trying to deploy the XDR agent on multiple Windows devices through the SCCM tool, but first, he wants to create a .bat file format of the agent to push installation through the centralized tool. Can anyone help me on how I can achieve this? Thanks in advance! **************** WR, Sayooj Dinan

Cortex Xdr is capable DLP?

HiI have a doubt about cortex-XDR. That is, my entity was implemented in cortex-XDR, but I have to know if XDR has a capability with DLP. Can I use XDR for DLP? Regards, Salivan

Discussions

Welcome to the Cortex XDR Discussions!

I can uninstall cortex xdr 8.2 agente in safe mode without password