Bitlocker events

[KarlHalpin]

Hi Everyone,

We are looking into using XDR to monitor bitlocker I know we can monitor if the volumes are encrypted or un-encrypted etc.

But is it possible for cortex to pick up pin changes from the endpoint events and if so does anybody know a good query for it?

would like to pick up people not changing their pin from the default.   

[bbucao]

Hi KarlHalpin,

Here is a list of the data collected by the agent, It does not look like any of these would include BitLocker events.

Regards,

Ben