Cortex XDR agent removal

[Natig.Rahimov]

Hi all,

In one of our endpoints XDR agent triggerd an alert named '

Suspicious file modification detected '  cmd is 'C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}'  after this XDR service cyserver was stopped , now status is disconnected, we don't have data to analyze the issue. what can i do

[nsinghvirk]

Hello @Natig.Rahimov 

Thanks for reaching out on LiveCommunity!

Please open a TAC support case to investigate the issue.