Cortex XDR Discussions

Welcome to the Cortex XDR Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Resolved! IOC Rule has been disabled - Auto Disable limit 5000 too high

Hello dear community, we had a nice expierience today with a FP (IOC, IP). We got about 2000 E-Mails and there were more than 5000 alerts, so Cortex auto disabled the IOC. So far, so good. In our case it would have made sence to reduce the treshold to our own limit, because 5000 is too high for us. What can be done here? BR Rob

Third party security solution integration with Cortex XDR

Hello, We are using Pro Per Endpoint license. Is that possible to integrate Third party security solution with Cortex XDR. If it is Yes, Which tool we can integrate as a best practice.

Host Firewall

Hello, Can the Host firewall option be enabled? If enabled, what are the impact? Can this be considered as an alternate option for network segmentation? If enabled, will be there be manual intervention needed to manage the firewall on endpoints? What are the settings and usecases (rules) that can be created for the firewalls?

Resolved! Blocking IP via host firewall

Hi Team, Is there a possibility to block specific external domain ip addresses via the cortex xdr host firewall?

Resolved! How to Enable Report verdict as Incorrect Option in Cortex XDR

Dear Team , We have assigned role to several XDR analyst for incident response but we cannot find Report verdict as Incorrect Option in Key & Artifact section. My doubt is how can we configure the setting in role section of XDR to enable the Report verdict option . So that Analyst can use that feature. Note : We cannot provide admin p...

Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

I have installed Cortex XDR on my corporate laptop which runs the subjected Linux operating system. I used the DEB package and used below command to install. sudo dpkg -i <cortex_pacakage>.deb But after the installation Cortex agent is not running properly. Please see to the attached screenshot.

Resolved! Blocking EFSRPC

In the 7/17 content release notes, improvements have been made to "Suspicious Encrypting File System Remote call (EFSRPC) to domain controller' generated by XDR Analytics BIOC detected on 2 hosts." By default, the action for this is to detect/alert. I would like to change this to block. Does anyone know how to accomplish this? Better yet, what i...

Resolved! Server 2022 and Microsoft Edge

Hello, After applying Microsoft July 2023 updates to server 2022, Edge no longer works. It opens to a white screen and then crashes. Event Viewer shows a faulting application name; msedge.exe. Windows 10, 11, Server 16, AND 19 all seem to be working fine. We are running a couple of different versions of Cortex XDR (8.1.0.40433 and 8.0.1.3380...

url blocking

How do I block a specific url using edl?

Resolved! Endpoint ID

Hi, Can 2 endpoints have the same endpoint ID, coz we observed 1 endpoint got removed from the console, and upon checking the endpoint ID of the missing endpoint is present on the console but with a different hostname. Thanks

To run an XQL query for USB device being plugged in the environment

I am looking to run an XQL query to search for the USB devices being plugged into the environment. Can anyone please help me out so I can figure which USB devices have already been plugged into the environment at the client's office. #usb #xql query

Resolved! Cortex XDR query.

This email was received from the PA team regarding the new upgrade, but the agent version number appears to be outdated. Please validate and provide further information. Dear Valued Customer, We are happy to inform you that the Cortex XDR agent 7.9.3 maintenance release is scheduled for General Availability (GA) on July 31st, 2023. O...

Cortex XDR

How to restrict large file upload in cortex xdr via https or smtp.Need to do size restriction.

Resolved! Force logoff of user during isolation of endpoint

Is there a way to force logoff of user during isolation of endpoint? Want to make sure that if computer is infected, it prevents user from logging back in to computer.

Regarding the device control function of XDR

Hi everyone, I configured profile to block all types of devices, and called in profile, it works fine. Now due to work needs, I want to allow specific USB sticks. I know it's possible to configure a global exception to allow a specific USB device, but after I added a USB device to Device Permanent Exceptions, it wasn't allowed. A pop-up me...

Discussions

Welcome to the Cortex XDR Discussions!

Resolved! IOC Rule has been disabled - Auto Disable limit 5000 too high

Third party security solution integration with Cortex XDR