XDR agent install rolls back

Hi all,

 Has anyone ever had it where an agent will lose connectivity with the management console and will not reinstall afterwards? 

 I have an endpoint that lost connectivity with the console. Would not check back in. I removed it via the Control P

Adding Endpoint to Dynamic Group by "Installation Package" Name

Hi there,

Recently I have received a request from client that they would like group endpoint automatically by the installation package, just like their previous deployment of their existing endpoint agents. Since it is much less admin overhead and

Outdated content update

Hello , 

What could be the possible reasons for outdated content version despite the agents running in the latest agent version .

Regarding running of command

Looping in queries , Hi , I want to able to query if a particular command was executed after another one . For example if sudo was executed and then another command . How do i query that ?

External Alerts Mapping, Alerts are always assembled to one Incident

Hello,

I have a little issue and I don´t know how to solve it.

Hopefully someone knows a hidden or 'unofficial' feature of XDR regarding this.

Briefly explained the structual background:
I am logging from diffrent Forti Firewalls into the XDR, thi

May this cmd for password query could find into a content update?

https://twitter.com/VirtualAllocEx/status/1599048829084794880?s=20&t=V1OyrvuCbhYez-wkSXNk1A

Or ist there a rule ready for this?

BR

Rob

XQL Query DNS resolutions

I'm attempting to pull out the name, type, and value from the dns_resolutions data

The below query results in "FAILED TO RUN QUERY" with no data, removing the alters does return data however no fields available return "value" in the dns_resolutions 

PoC - Using Cortex XDR to Block Software Installations

-

MTTR - MTTA

Hello, is there a way to compute the Mean Time to Acknowledge (MTTA) and Mean Time to Respond (MTTR) statistics of all the cases ?

thank you in advance

Cortex XDR

Can I disable the Cortex XDR on anyone of the endpoint(workstation or server) for temporary purpose from the XDR Console.