Detect and Restrict Powershell cmdlets

Hello everyone,

I would like to know if any of you have struggled with support and technical cases with the need I show below.

I would like to know what you can tell me or give me your opinion about taking action against powershell cmdlets.

After sev

BIOC API access

Hello Folks,

In the Cortex API documentation there is not mention of how to make BIOC rules using APIs or how to access them.

I was wondering if anyone has been able to use the API to create BIOC rules.

Creating a ServiceNow incident by taking the Slack user responses

Hi All,

We have a requirement to create a ServiceNow ticket by taking the slack user responses.

I have built a playbook which does send the SlackBlockBuilder to the specified Slack channel but the playbook runs only when an incident is attached to it

Automation rule to add IP address to EDL

Is it possible to create an automation script or rule to add a remote IP address to an EDL in Cortex XDR?  I'm exploring the best way to handle this.  For example, after the recent CVE-2024-3400 disclosure, I patched my firewalls, and all is good.  H

Tons of receptivity.io

I recently see a lot of my end machine shitting this domain: receptivity.io

Started (I dunno even know, a week ago?) My logs can no longer go far enough back to figure it out.

Cause I dunno, MS edge new tab? To hopefully remove the log entries I

Scripts Library

Hello everyone,

What types of scripts have you configured in the 'Scripts Library' of Cortex XDR and for what purpose?

With these scripts, is it possible to create automations?
For instance, to detect if a certain computer has any software installed..

Automatic deletion of files suspected/confirmed as malware

Hi all, 

Can the XDR auto delete files it has flagged, be it by local analysis or wildfire analysis? Or does it just block and quarantine files?

On-write Protection is disabled by default

Hi everyone, 

Just wondering how's the performance or resource is impacted when this protection is on, i bet it would have certain impact as this is "Disabled" by default. or any other concerns if ON?

Any experience to share?

thanks 

AD Cloud Identity Sync - computer description

Hi,

I synchronise our on perm Active Directory to the Cortex XDR and this is working well. I'm creating some reports using XQL quires based on pan_dss_raw dataset. My only problem with this, that in the Schema I can't find computer's "Description" wh

Cortex XDR Upgrade from Pro to per GB

Hello dear community, 

we would like to ingest logs for more visibility. 

Actually we have Cortex XDR Pro. 

How does the upgrade path look like to get the ability to ingest FW and Windows Event logs? 

How much more we need to pay and how does the l

Cortex XDR Pro - Looking for Scheduled tasks by name in mass?

Hello dear community, 

here is a script for searching specific scheduled tasks by name in mass. The search is via LIKE and wildcards are used. 

NTA in XDR

Hi All,

We want to enable this feature on XDR, can someone please guide us with the pre-requisites and what steps need to be followed to enable this feature?

Thanks,

Shahwaz

Cortex XDR dashboard into Grafana?