Parsing out VLANS from netflow collection

In Cortex XDR I'm trying to figure out how to create a parsing rule that will allow me to drop anything from certain VLAN's prior to it ingesting.  Trying to use the Collect and filter but can't seem to figure out how to exclude a VLAN without having

XQL Query to list top process causing issues

Dear All,

I would like to know how to build a query to troubleshoot issues on a host where I wanted to list the processes running on the host and also to identify which is causing the issue. I am writing the below query to find no details, please h

NTA Dashboard

Hello all,

My goal is ingesting the log from my Fortigate for correlation and analyses.

I'm evaluating Pro per TB now, done the configuration already, actually, the log is receiving now.

Found the new NTA Dashboard, however, it showed No Permi

Get-Idea to use api get all endpoint with last seen

Hi Expert ,

I would like to get all endpoint install xdr but would  like to know condition last seen such as more than 1 month I use python 

Thank you

Cortex XDR Vulnerability Assessment - Linux Backporting Security Fixes

Dear community

When using the Vulnerability Assessment with Linux hosts, the results may include a lot of false positives.

Distributions which are backporting security fixes (CentOS / Debian) do may not change the App Version when they got patched.

htt

Compile Payload Source Code Locally

Dear Team,

We wanted to restrict compilers on our environment after a pentest resulted with Compile Payload Source Code Locally, we have common compilers like csc.exe and GCC/MinGW. 

We wanted to know how to identify any common suspicious behavio

Forensics on deleted files on Endpoint

need to know if XDR has the capability to perform forensics on Endpoint if user deleted any files on computer.  If so, how would you go about performing this task.

,Download the freshly created xdr-distribution-file

Hello

I'm looking for an autmoatisation, where I'm able to download the freshly created xdr-distribution-file.
In my Playbook I've created following steps:

xdr-get-distribution-versions
xdr-create-distribution
xdr-get-distribution-url

Now, the last step