Cannot upgrade The Cortex XDR from 7.9.1.26645 to 8.1.1.43337

The error message is that Cortex XDR requires Azure Code Signing support. See Microsoft KB5022661 for details. The I navigated to https://support.microsoft.com/en-gb/topic/kb5022661-windows-support-for-the-azure-code-signing-program-4b505a31-fa1e-4ea

Block versus Quarantine Malware Module Settings

Is there a greater benefit to enabling the Quarantine setting versus the Block setting across the different modules in the Cortex XDR Malware profile? It is my understanding that both/either will result in the expected protective action (i.e. a poten

cortex XDR Java API available ?

Hello, I will be using Cortex XDR to scan files in my project (Spring based project) while uploading.

I was searching for a JAVA API which can be used to call Cortex XDR endpoints but couldnt find anything.

Does any one has idea about same ?

Analytics BIOC Rules Incidents

Hello,
By checking a specific Analytics BIOC Rule, I see that it has created several alerts in the past. Some of these alerts have been associated to an incident id. These incidents contain only that specific alert and no insights.

Why the specific

XDR Alert Exclusion

Hi,

I excluded an alert from an incident.

But i am not able to see that exclusion being created under Settings > Exceptions Configuration > Alert Exclusions.

May i know why?

Kindly help.

@mcooley 

Thanks,

Nithin

XDR Masquerading Incident

From few days getting the alerts under the "Masquerading" alert name. when we analyzed we observed there is a .exe file creation in the sysmon folder with the long string "C:\Sysmon\2BE609177094318EA49602B566942D95E6C81494161F8EC8A3AA6AE26FFCDD14F8F5

Cortex XDR 7.5.3.60113 cannot uninstall

Dear Team,

I have a cortex xdr 7.5.3.60113 cannot uninstall.

all service has been disable. somehow, i uninstall it untill 99%. it will rollback.

Could you please advise how to uninstall it completely or any uninstall cleaner can provide? thank you.

B

Cortex XDR Auto Quarantine

Hey all,

Does anyone have experience with turning auto quarantine on?

I don't see much documentation on it but I'm assuming its as simple as quarantining the files associated with Wildfire verdicts.

We're looking to set up recurring malware scans

Cortex XDR Pro - Forensics Addon - WEC

Hello dear community, 

If we choose to gather forensic artefacts from a WEC, which event logs will be forwarded? Only the one of the machine or all the collected logs from the forwarders?

BR

Rob

Kandji MDM

Hello everyone,

Over the last two months we are having constant issues with Cortex and Kandji playing nice together. Before that everything was working without any issue for at least half a year, if not longer.

What happens is the following: Kandji g