Cortex XDR Device Control Violation Query

Hi Team,

How can I check device control violations using an XQL query? I have tried the query preset = device_controlbut I am only seeing details for USB device violations. I am expecting to see Bluetooth violations as well. Is this possible? If yes,

Questions about IOC/BIOC Suppression rules

We are doing a (somewhat rushed) Cortex XDR implementation, and I am new to EDR things (in general). 

I created an IOC/BIOC Supp rule today for an issue with running the Guardian Browser (I'll let you know if it works), and while there I see 52 Sys

How to remove Old versions of Cortex Agent

Hello everyone,

We're facing issues upgrading older versions of the Cortex agent on Windows endpoints — particularly versions 7.x and in some cases 8.x. These agents fail to upgrade both automatically and manually.

Requesting a cleaner for each min

Port scan alert

Hi everyone,

There is some situation in our case.

For example there is 2 windows host. Host1 and Host2. Host1 have XDR. But Host2 not. If Host2 executes port scan action (it doesn't matter which tool is using -- nmap, zenmap and etc) to Host1 in

Cortex XSoar (cloud) seems to be down

We currently can't login in our XSoar instance. Ticket is already created but no answer so far. Does anybody know about this issue? 

Cortex XDR login issue

Hi everyone,

I can't sign in to Cortex XDR Console for about 10 minutes. I receiving "Unauthorized - 4010402" for 3 different users. Is it general problem or only for my tenant? I have also another tenant and it works normally. Could you help me?

XDR version 3.x vs 4.x

Hello Experts,

I noticed there's two versions of XDR 3.x and 4.x, Mine is running 3.x. noticed that's quite lot of changes (in UI) for 4.x.
1) will my XDR  be upgraded to 4.x eventually?

2) when?

3) what is the purpse of running both version?

4) is 4.

How to Get All Filter Parameters for Cortex XDR Incident or Alerts URL?

Hi Community,

I'm currently working on building deep links for Cortex XDR to directly access filtered incident views via URLs like the one below:

error when try to install cortex on redhat 10

Hello,

I try to install Redhat 10. i downloaded last version of packages.

When i try to install on rehdta, i have this error :

./cortex-8.8.0.133595.sh
Verifying archive integrity... All good.
Uncompressing Cortex XDR 8.8.0.133595 installer 100%
[!

action_process_image_command_line Filter Issue

Hi, I'm trying to build a query that would check for reg.exe launches. This is well and good, but the moment I add a filter action_process_image_command_line = "reg save" nothing appears, even though it was part of the initial result for reg.exe. Whe

Request for informations about linux 8.7.1 Cortex XDR agent issues

Hello,

I'm looking for information about possibles issues with Cortex XDR 8.7.1 on linux. We were informed of possible issues specific to 8.7.1 but the message is not helpful on what we should be aware of, to know if we are affected and if we should