Join two data sets XQL

Before I get into my failed script, please allow me to explain what Im attempting to do.

We are looking for windows and Macintosh devices with cortex xdr agent NOT installed.  To do this we installed the cortex DHCP log collector. It is reporting its

Modifying Policies and Profiles on XDR

Dear All,

I wanted to create an XQL Query to identify the modification of XDR policies or Profiles by anyone who have access to XDR, so that I wanted to get the list of users who tried to modify the policies or profiles.

I wanted to convert the X

Auto Agent Upgrade in 3.6 version

Hello Team,

Since the new version of Cortex has come out 3.6 version. 

Wanted to get clarity on auto -the agent upgradation part.

Is it recommended to upgrade your agents(servers/workstation) to N-1 or latest version via auto agent upgrade policy?'

File search based on Host

Is there any option in Cortex XDR, where we can check which all hosts have a specific exe present? 

For eg We want to get a list of hosts which has google chrome installed in it.

Regards,

Shashank

Linux operation mode (Pending)

Dear All,

I wanted to create a widget to display the details of Linux Operation Mode, can someone help me how I can start with, I am still a rookie in XQL Query.

TIA

Agent Blocking files/processes dynamically based on conditions

Hello XDR Enthusiasts,

I am working with multiple XDR Tenants and would like to block a file/process based on conditions. I understand that you can use the Prevention features to block files based on a block/black list. This can also be configured on

Detect critical assets without agent

Hi,

I need to create an alert everytime asset with tag critical has no xdr agent installed, it is outdated, disabled or disconected.

Regards,

Fábio

Outlook stops syncing with Cortex XDR enabled

We have 2 Cortex tenants with a total of about 600 users. We encountered an issue where Outlook 365 will show "Needs password" and will not connect to Office 365 to sync. The only way to get it to sync is to stop the Cortex service. Once Outlook conn

Will Cortex XDR also checks for rogue/malicious browser extensions & blocks them from adding ?

also how to get visibility into the browser extensions used through Cortex XDR ?

Top 10 Incidents in Last 30 Days

There is one Top 10 Incidents widget provided in Dashboard builder which provides list of top incidents in last 24 hrs only, can anyone help me how to get data for last 30 days. Cortex XDR