Malware detection

[sathishkumar.c]

Hi Team,

In our environment, a file was detected as malware. Based on the investigation, the file was downloaded using Firefox. We need to identify the exact source URL from which the file was downloaded.

We have already checked the Causality Chain for the file, but multiple URLs are displayed, making it difficult to determine the actual download source.

Could you please advise how to identify the exact download URL in Cortex XDR? Specifically:

• Is there an XQL query that can correlate the downloaded file with the corresponding network connection?
• Is there a recommended method to identify the exact URL when multiple URLs are present in the causality chain?

Thanks,

Sathishkumar C.