How to find the Cortex XDR client Policy Profile name from Windows without Local Admin

[tingmy]

As different Cortex XDR Policy profiles can be pushed to different users, it is sometime required to find out what is the current XDR Policy Profile used by a particular endpoint.

If the endpoint has local administrator privilege, we could just search in the *.ldb files in the following folder for the name of the profile used.
C:\ProgramData\Cyvera\LocalSystem\Persistence\agent_settings.db\

The pattern to look for is in JSON like below:
"mpm":"Xxxxx","agset":"Xxxxxxxxxxxxxxx","restr":"Xxxxxxxxxxxxx","name":"Xxxxxxxxxxxxxx","epm":"Xxxxxx","exceptions":"Xxxxxx)"

If the endpoint does not have local administrator privilege, there seems to be no legitimate method to find current XDR Policy Profile used.

Before version 7.8, we could at least "Generate Support File" on the XDR client and find the *.ldb files in the generated archive file. But newer versions of XDR after 7.8 encrypts the generated support file.

Does anyone know if it is possible to find out the current XDR Policy Profile used by a particular client endpoint without local administrator privilege?

[bbucao]

Hi Tingmy,

Tracking the policies applied to various agents can easily be done from the Cortex XDR Cloud Tenant, this is the standard way you would track and manage your agent profiles and policies. Is there a particular reason you are needing to do this from the endpoint?

Thanks,
Ben

[tingmy]

We are an intermediary security group, so we do not have access to the XDR admin portal. During troubleshooting of end users' issues in previous versions, we find it more convenient to get the users themselves to check the policy profile names on their endpoints, as opposed to emailing the XDR admin.

Before version 7.6.x, it was possible to check the log files directly. During version 7.7.x, we can get the users to generate support files themselves. After version 7.7.x, the support files are encrypted, and require the XDR admins to generate the archive password.