Can we able track power shell execution blocked servers' usage?

[PoojalaSreenadh]

Hi Team,

we have created a policy for PowerShell execution blocking. whereas included with systems and servers. we have a few more servers that do not come under the PowerShell execution blocking policy as well. Here my doubt is can we able to track the usage of servers which is in PowerShell execution blocking policy? first of all, can we able to track the server's usage by using the cortex XDR with an EDR premium license? 

[PiyushKohli]

Hi @PoojalaSreenadh 

Thank you for writing to live community!

By PowerShell execution blocking policy are your referring to execution policies that are set by Set-ExecutionPolicy and Group Policy settings. If yes, How about using the Endpoint script locate under (Incident Response -> Response -> Action Center -> New Action -> Run Endpoint Scripts) and from Scripts select execute commands. In the command you may mention something like "powershell get-executionpolicy" you can modify or update based on your requirements and in the script output you will get results of the script. 

Then you may filter based on the Policy you applied for blocking vs Non blocking.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

[PoojalaSreenadh]

Hi PiyushKohli,

Thanks for the response, but my concern is whether can we able to track the usage of servers using cortex XDR pro per endpoint license. if yes, how does it view. 

[PiyushKohli]

@PoojalaSreenadh could you elaborate what do you mean by "track the usage of servers using cortex XDR pro per endpoint license"? What usage you want to track? Could you share some example or reference like what/how are you currently tracking the usage of servers which you want to check if it can be done using cortex XDR pro per endpoint license.

Thanks