Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Resolved! Excluding hash for particular machine

Hello Team, - We have added one of the hash in the block list and it is quaratined. - In one of the test machine we need this file for testing purpose. - Is that possibke to exclude this hash from the particular machine?

High medium low severity

Dear Team , On what basis high ,medium and low severity alerts/incidents are classified on cortex XDR Regards, Shashank

Resolved! Legacy Exceptions removal

We're looking through the Legacy Exceptions and some are no longer needed. To do this, do we need to activate them and then remove these exceptions? Also could I please confirm that these exceptions already exist in the system and by clicking activate, we are migrating them so that they can be managed centrally? Thanks

Resolved! Manually update content version?

Is there a way to manually update the content version? I downloaded the agent install plus latest content version and I can't figure out what to do with the content version files or find a way to push the latest content version. This particular machine is stuck on 188.xxxx even after an uninstall/reinstall. The agent is talking to the server and...

Resolved! Cortex XSIAM + XDR

Hello dear community, who of you is using XSIAM? How is it? Will XDR + XSIAM ever get together in one product? BR Rob

Resolved! XQL filter o365 attachments

Hi, I am trying to filter o365 attachments without success, could you help pls sample [ { "@odata.type": "#microsoft.graph.fileAttachment", "@odata.mediaContentType": "image/jpeg", "id": "AAMkADEzYjJhMzM1LTY0ODctNGUxOS05ZDc5LTQ2MWM3NzFmMTRjOABGAAAAAABaN8y0q3IrQ6fyDga7Z5M3BwBvSXHDOoi0TJ5-l2B-i9PgAAAAAAEMAADyHfSb-T8wR5Fak3aFlfa...

Cortex XDR with VDI persitent Desktop

Hello, We use the Vmware Horizon VDI solution in Instant Clone with FSLogix profiles and a dedicated machine based on a Golden Image (Automated, Instant Clone, Dedicated). A user therefore always connects to the same machine, which is updated from time to time from the Golden Image and the machine is never destroyed until user leaves the com...

Smartscreen functionality side by side with the Cortex agent on FAT-Client (not Server)

Hello dear community, the Cortex XDR agent disables Windows Defender on FAT-Clients automaticly. Does Smartscreen in "App & Browser Control" still work in this state? BR Rob

Resolved! Possibility to use cloud tags to replicate them into Endpoint tags.

Hi, is there a way to re-use populated Cloud tags (eg. from AWS cloud) into Tags used for Endpoint distinktion and dynamic group definition? Thanks Ondrej R.

Multiple detection on Suspicious Network Activity - 3045255237

Hello , We are a MSSP and since less than one hour, a new rules appeared in many of our Cortex XDR tenant : Suspicious Network Activity - 3045255237 involving the IP 2.58.113.190. The communication is launched by the process System, like if a rootkit has been woke up. Whereas the description says "Generic Webshell Command and Control Traffic D...

Resolved! Can be into Cortex XDR ingested JA3 hashes

Hi,I would like to check whether there is a way how customer can ingest IOC in form of the JA3 hashes into XDR? thanks Ondrej

Help with t XQL BIOC/Correlation rule

Hi ALL,New to XDR world, I am have a XQL query against a 2FA log which looks for user login (fail or success) from 2 different countries in 3 hours. Query looks like dataset in (XXX_raw) | filter eventType = "User.Login" // look for login events| comp min(_time) as Firsttime, max(_time) as Lasttime, count_distinct(country) as location_count, ...

Resolved! ServiceNow CMDB integration and how to use it according to best practise

Hi,we have successfuly integrated ServiceNow CMDB into Cortex XDR and have fetched data to datasets servicenow_cmdb_*. We did not find in the Admin guide information how and if those ServiceNow CMDB data will be propagated into Asset information in the XDR console. Does anybody knows how to uilize those CMDB data for enriching information abo...

Batch file creation in MAC to Fore Reconnect Cortex Agent

Hi Everyone, I would like to force reconnect the workstation that is in old Cortex Tenant to the new Cortex Tenant we have. Is is possible to create a batch file for this so it can help us to work easily? is the .bat format applicable in MAC OS? Thank you in advance everyone! Hoping to hear from you all your thoughts/insights. Regards!

XQL Query to view the "Incident Name"

Hi People, I was wondering if anyone could assist me with XQL Query to display the Incident name. Please refer to the attached photo to get an idea of what I am trying to achieve. I have used the xdr_data dataset, however i cannot find the relevant field. Appreciate anyone's support. Please note you are posting a public message where communit...

Discussions

Welcome to the Cortex XDR Discussions!

Resolved! Excluding hash for particular machine