CONTERX XDR Agent Brute-Force attack and NMAP scan detection.

[M.Sorokins]

Hello !

Is it possible with CORTEX XDR Agent installed on Windows/Linux Server to detect:

- ssh/rdp/ftp and WEB apps brute force attack.

-NMAP scans.

Thanks in advance,

BR,

Max

[neelrohit · Accepted solution]

Hi @M.Sorokins ,

Thank you for writing to live community!

While this forum is directed for cortex xdr related discussions, we do not have a specific capability endorsement or discussion that we generally cite. Cortex XDR definitely has UEBA based capabilities and network traffic detection capabilities based on telemetry collection. However, specific attack use cases require patterns and attack cycles which qualify as a MITRE ATT&CK lifecycle use case.  I would highly recommend reviewing this analytics reference for detailed insights on detection rules and encourage testing the specific use cases for validation.

Hope this helps

[M.Sorokins]

Thanks !

>>Cortex XDR definitely has UEBA based capabilities and network traffic detection capabilities based on telemetry collection.

Yes. It could be done via XQL queries with traffic and events patterns. It's not TRUE NIDS, but it it works.