Resolved! XQL query Help for custom XQL widgets

Hello

I would like to customize the standard "Detections By Actions" widget to filter only on true positive (resolved) incidents - for the last 30 days.

And I would like to customize the standard "Open incidents by severity" widget to apply on all in

Resolved! XDR Alerts

I want to process the alarms received by XDR. To do this, I first need to separate the incoming alarms according to their class. If I separate them according to source, I should examine them in 4 classes as "XDR IOC, XDR BIOC, XDR Agents, XDR Analyti

Resolved! Incident handling - quarantined files not filterable in the incident advanced view

Hello dear community! 

I whish there could be a column, which could make us see, if the file is quarantined. It just exists in the Executions index tab and there you cannot see in one step if the file is quarantined or not. 

It would be very helpful,

Resolved! Cortex Scanning

Hi, I'm looking at doing a review on our Cortex policies and we currently have weekly scanning enabled. I know scanning for Cortex is not a traditional antivirus scan, but more for creating a benchmark for your endpoints.

After it does a scan, alerts

Resolved! timestamps for suppression rule (BIOC)

Hello everyone,

I need your help because I want to create a BIOC deletion rule, I have the hash, the username and the path but I would like this deletion to be effective during a specific time slot, can it be configured?

Resolved! Block Exe Files in User Download Folder

Hello,

i know that i can block specific files in cortex but i am looking for a solution how i can block only .exe files in Users download folder.

In the Malware Profiles i can see that there is only a allow list where i can write single filenames t

Resolved! Network Configuration Module

Hello,

What exactly is the use of the feature called  active assets and active managed assets in the IP ranges section under the Network configuration module.