Cortext Modifying App Java Threads Without Warning

[dvs2025]

Cortex is currently messing with a java app at a customer site.

We have a tomcat-based java app that we take to market. Cortex is currently messing with it. Cortex on, our app has issues. Cortex off, our app runs fine. Copy the entire folder and run on a different box without Cortex, the app runs fine.

Major problem is Cortex is not throwing any errors. It is just deleting or modifying the threads.

We use Java Agent to  augment the system JVM class - java.lang.Thread to include our session ID (which we need to manage our threads).  Using Java Agents is a legal and a very common way to load custom classes into JVM at runtime. 

After we launch our app, Cortex notices that the original JDK class was modified and plugs it right back in... probably using the same technology. It does it silently (without issuing any warnings or errors we can intercept).  

The Cortex team at the customer site is investigating. However, this has delayed our rollout at the customer for 3 months. The first 2 months trying to figure out that Cortex was the problem... and the last month trying to figure out how to get Cortex to stop messing with our app.

Any ideas? Anyone know how to keep this from happening?

Appreciate any and all help you can provide!

Thanks,

DVS2025

[eluis]

Hi @dvs2025 

You can use the alert tunning and how the malware modules behave to generate alerts or to not generate alerts. 

If you think that Cortex XDR is blocking legit behavior without a reason, please open a TAC support ticket  and provide the information that TAC team will ask you for further investigation. 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis