Cortex XDR Discussions

Mac Cortex XDR Upgrade causing Device Freezing

Hello,

My organisation is currently running Cortex XDR 8.6.0 on Sequoia. We're finding that when performing upgrades of the application via the Console or by Jamf that the who device will freeze for 15+ seconds.

We're in an environment where we'r

Why there are no related alerts on scanned malicious files.

Hi, we have recently malware scanned an endpoint and upon checking the results, it appears that there were 3 malicious files on the host.

Now, I tried to right click and view related alerts on the 3 malicious files and it just shows nothing. What's

Discrepancy Between Connected Endpoints and License Usage in Cortex XDR

Hi Team,

We have observed that the Cortex XDR management console shows a total of 385 connected and disconnected endpoints. However, the Cortex XDR license usage is showing 348. How is this possible? Please explain.

Zulu Time and Convert

so my goals is to convert a jsonextract of a few time stamps:
I want to combine them and make a total hours. so start time and expiration time = how many hours total. I cant seem to get the time formatting from a string or I am doing something wrong

Cortex XDR 8.2+ Not Able to Uninstall - Not Showing In Programs (Windows)

TLDR; Cortex dashboard shows EOL agents on Windows machines but upgrades fail, uninstalls fail, and Cortex is not showing as an installed program. However, Cytool can be disabled/enabled.

-----

We have a few machines with outdated agents. Using the C

Creating a stacked bar chart using XQL

I am creating a stacked bar chart that shows the number of alerts per data source per day.
Is it possible to display the data source in the displayed graph?

The stacked bar I created shows the time.
※Whatever I select for the X-axis will be displayed

XQL query for vulnerability

Hi. i need to do monthly report for vulnerabilities. So how to create like a trend report for 30 days

here is just example for get count, but how to do  trend report?

dataset = va_cves 
| filter severity >Medium
| filter affected_hosts_count >1
| fields

how to uninstall a package using rescue mode in Debian

my debian server crushed, wa are unable to acces the server(VM on OVH baremetal) using ssh(hard disc), we can usig rescue mode using the root user. after investigation we found that, it is a network problem due to Cortex, now my question is is there

Malware Scans on Linux Endpoints

Hi Team,

Can you please confirm we can run malware scans on linux servers and linux virtual appliances? We want to create a policy in XDR to run periodic malware scans on the servers (Specially linux servers and linux virtual appliances). 

Regards,
Saks

The USB Read-Only policy causes the USB drive to fail to mount

I have set a USB Read-Only policy under Policy Management Extensions -> Policy Rules and Profiles. When a USB drive is inserted into an endpoint, Cortex XDR triggers a notification indicating that the USB is mounted as read-only, but in reality, it i

Cortex XDR blocks MalwareBytes

After a recent update to MalwareBytes Cortex XDR is now detecting and blocking it.

Has anyone else seen this, and is there a was to allow the MalwareBytes Digital Signature? I prefer not to have to allow the hash for each version.