Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

block powershell but allow only specific powershell script

we need to block powershell in all endusers pc but allow only one particular script to be allowed to be run in powershell is there a possibility.

Resolved! XQL query for cloud assets

Dear community, I've trying to build an XQL query to search for the cloud assets that does not have XDR agent install. From the GUI, these data is available under the following 2 locations: - Cloud Inventory --> Specific Cloud Assets --> Compute Instances - Asset Inventory --> Specific Assets --> Cloud Compute Instances My very f...

Amazon WAF Log Ingestion in Cortex XDR Management Console

Dear Team, I kindly request confirmation regarding the feasibility of integrating Cortex XDR with Amazon WAF logs. If possible, could you provide guidance on how to proceed with this integration? Additionally, please share any related documents or resources that could be helpful in this process.

Resolved! Understanding The Process Tree

Hello Everyone,My intention is to fully understand the process tree naming convention for cortex XDR and the more I look at the logs the more confusing it becomes.From my understanding the process tree from child to grandparent should look like below action_process - child actor_process - parent os_actor_process - ??? causality_actor_process -...

Cortex XDR - Endpoint Group changes notification contain problem

In Cortex XDR, on the Endpoint Group side, we statically select different endpoints for certain groups. We receive notifications about changes in those groups, but the notification does not show which computer is selected statically for that group. For example, as shown in the attached screenshots to the query. I linked the computer "User0XXXX t...

Cortex XDR service allocate Seperate/additional CPU

Hello Team, Cortex XDR service to be allocated separate/additional CPU threads other than CPE & ICN WAS CPU. Is it fine to go ahead or will it cause any issues.

Custom Widget to Show All Alerts and remediation steps

Hello, I am trying to create a custom XQL widget to show all non info alerts and the suggested remediation steps in last . Please advise!

Question regarding random Decryption when using Cortex XDR

Hello all,Wanted to ask if any of you had something similar happening around.Scenario : 2 systems (just as an example, as they are more) - 1 of the systems gets decrypted after a system update was done (BIOS, driver updates etc.) , the other system does not get decrypted for the same updates, instead the BitLocker suspends itself and after the u...

Resolved! Cortex XDR Incident Management Report by tags

Hi all, I need to create an Incident Management Report by using specific tags. Is it possible? Maybe I can do it via XQL query? If not, do you have any suggestions on how can I create incident reports for different tags? (I don't want to export the incidents and create reports via Excel!!!:D) Best regards.

Administrator group from the XDR console

Hello, We need to pull out list of member IDs from Administrator group from the XDR console.Kindly help us in retrievng that data from the XDR console.

Need the details regarding Cortex XDR agent traffic to internet or broker VM

Hello Team,Please let me know how much 1 agent of Cortex XDR can send request to XDR cloud(internet) or broker vm send request to cloud in duration of 1 minutes of time.Need this information to understand about the Cortex XDR agent traffic towards cloud and count of request/connections per 1 minute. Cortex XDR #brokerVM

How to import a multiple hash value in block list

Hello , Is there any option available to upload multiple hash value in block list using CSV file. I had checked for cortex xdr import file hash exception however its really difficult to find out the filetype for each hash value. So is there any option to ignore this and add only hash irresp of file type.Cortex XDR

Agent Upgrade Failure

Hello Everyone, I'm having a problem when upgrading an agent, it just gives timeout. From what I can understand, both these systems are "the same" but CALPE doesn't upgrade... I saw that it could be from a problem with Windows Azure Code Signing KB5022661 but when I check with "test_acs" it doesn't give an error... Any help is appreciated!

Resolved! Retention time for new datasets

Hi all Does someone know which retention period is used for datasets created through correlation rule or scheduled query?

Resolved! Iterating over an array in XQL

Is there a way in XQL to iterate over an array? Imagine there is an array of mail receivers i want to check if each one contains a specific keyword such as "@company.com" so that i know there's no receiver outside my organization. emails = ["user1@company.com", "user2@anothercompany.com"] - i want to detect the second email.

Discussions

Welcome to the Cortex XDR Discussions!