Cortex XDR: Bitlocker Monitoring

[PBurns]

Hello everyone,

We are looking at using XDR to monitor Bitlocker status on Windows machines. On the 'Disk Encryption Visibility' page, we can see the Encryption status, but there is no way to filter on 'Unencrypted' drives.

- Does anyone know of an XQL Query to show only the drives unencrypted? 

- Does anyone know of an XQL Query to tie to a BIOC and alert if a drive becomes unencrypted? 

Thanks for taking a look!

Peter 

[PBurns]

It looks like we have ENCRYPTION STATUS in the Endpoints data set, but not VOLUME STATUS. At this point, we are not enforcing encryption by the policy. See below for a sample query provided by Palo Support:

config case_sensitive = false |
dataset = endpoints
| filter encryption_status = NOT_CONFIGURED or encryption_status = NOT_COMPLIANT |
fields endpoint_name

[etugriceri · Accepted solution]

Hello PBurns,

Thank you very much for the XQL query about status. for the BIOC question, you may write BIOC to checking specific registry path. Below is just one sample not tested but might help you to write a query for proper path.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSEncryptionType

0 = Allow user to choose (default)

1 = Full encryption

2 = Used Space Only encryption

or 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker

Value: PreventDeviceEncryption equal to True (1).

[Melvin_Machado]

Hello,

Have you made any progress?

I would like to set up an alert for disks with unencrypted drives.