Network Visibility on Cortex XDR

[ruslanal]

Hello,

In my organization we has recieved multiple alerts recently regarding suspicious communication towards our WEB servers.
The communication was from a workstation in the organization but we can't understand from which workstation because the communication was made through our proxy (the source workstation in the alert is the proxy server).

Is there a way to configure the Cortex XDR to full visibilty that will show us what is the source workstation behind a proxy (without activating the Data lake)?

[sramesh-7]

If Cortex XDR is setup on the endpoint and the process or file that performs such a scan is identified as a malicious behaviour or has a malicious file attached to it, it should flag an alert from XDR agent. However based on my understanding Data lake will be required for this.

[etugriceri]

Dear Ruslanal,

You can also add IOC for specific domain and XDR would be altered each time when your workstation reached that web server. 

[jcandelaria]

Hi Ruslanal,

Do you have any information on the alert what is the suspicious communication all about? Something to start with in terms of investigating? If you have Pro license, there is analytics and analytics bioc incidents/alerts that you can check. But if you have specific information to start with, you can use query builder/xql to start your investigation/threat hunting

[Remo]

Hi @ruslanal 

Did I understand correctly and you don't have cortex installed on the workstation, only on the webserver? If not and you have cortex on the workstation, then as mentionned by @jcandelaria you can start searching in the logs for thw connections to your proxy at that time (requires xdr pro)