Cortex XDR Discussions

XQL query custom variable

Hi,

I am creating a custom query where I will need to re-use certain fields.

Ex.: I want to search for:

-action_local_ip and action_remote_ip

-action_file_sha256 and action_module_sha256

-dst_agent_hostname, dst_action_external_hostname and http_se

...

Resolved! The Logic behind Widgets on XDR

Hello ,

Recently we observed that during time period of last 7 days when we use the widget Incidents by source it shows us of a total 7 incidents but when we check manually with the same timeframe it shows us only 6 overall incidents. How does thi

...

Resolved! XQL Query for incidents/alerts

Hello ,

Is there a way to create XQL query for the details related to incidents or alerts for past 7 days that can be used as a widget . The current widget options do no give us the output we require.

Thanks

Resolved! Perform Memory Acquisition Using XDR

Hi,

Is it possible to acquire memory using Cortex XDR for digital forensics? We are not looking for process dump but a complete memory dump of the system which we can further use with tool like volatility or something.

Thanks in advance.

Regard

...

Resolved! Bad Driver Blocks

Hello dear community,

Are these drivers, signers, etc. blocked by CORTEX XDR Pro?

it is a copy of the official provided list from Microsoft.

https://github.com/Harvester57/CodeIntegrity-DriverBlocklist/blob/99534db767c7c71826fa70d43f28a25b3cf7

...

Agent upgrade

Hello All,

We are trying to upgrade the agent version from 7.5 to 7.8 for all our devices. Right now we are testing phase and the agent seems to be failing on few devices when we did it from Console.

We did stopped services from CMD on affected mac

...

XDR Quick Scan

Hi , Does Cortex XDR have a Quick Scan feature?

Thanks.

Free Cortex XDR training!

Hello to all on the youtube channel for the live community there is a 2 hour free training. You can also test the Cortex XDR tool and schedule a workshop if want to play with the system a little more:

https://www.youtube.com/playlist?list=PLD6

...

Resolved! Does Cortex XDR Device Control blocks mobile hotspots through USB?

Hello!

I recently had this situation where a computer with a security policy with every setting in device control set to block allow internet connection through USB + smartphone.

Did you have any similar situations? I have checked device control

...

Resolved! XDR Cortex Event Forwarding into AWS S3 bucket

Hi!
I am looking for a way to export raw endpoint data from Cortex XDR to AWS S3 bucket,

I saw in the Event Forwarding option that it's possible to export these logs into Google Cloud Platform (GCP) bucket,

so I look for a similar option just into AW

...

Resolved! New version 7.0.8.64267

Hello everybody 

Do anybody know the fixed issued in the version 7.0.8.64267 or is there any release note?

Thanks 

Solution: How To View Cortex XDR Behavioral Threat Protection (BTP) Rules

Hello everyone,

We have, many times, received alerts with cryptic names like heuristic.agb.4477 or heuristic.b.346. Imho, creating a support case and waiting for a response is inefficient. Also, expecting us to blindly accept the support engineer res

...

'Failed Connections' alerts detected by XDR Analytics

Hello guys ,
Cortex flagged a security alert(low severity) related to 'Failed Connections' .
Observed these are network connections are initiated by brave browser helper / Firefox helper and these connections are made to private IP's. No malicious fil

...

XDR Analytics BIOC Alert exclusion

Hello dear community members!

how would you exclude this? It is only popping up in one of our houses/domains.

Maybe this way?

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bioc-analytics-specific-exceptions-and-vendor-exceptions/m-p/

...

Resolved! Bitlocker Volume Status questions

Hello dear community members!

What is the difference between the locked symbol with the exklamation mark and without?

Bitlocker is turned on through windows directly and not through cortex. Encryption Status = Not Configured.

We are a bit confus

...

Discussions

XQL query custom variable