The Cortex XDR not installed still incident getting generated

[Shinde_Dipak]

We have observed incident on the server in which Cortex XDR is not installed. The system is only present in the asset inventory. How is this possible, on what basis incident is getting generated?

Incident Name: Multiple Rare LOLBIN Process Executions by User

Thanks in advance.

[jtalton]

Hello  Shinde_Dipak,

'Multiple Rare LOLBIN Process Executions by User' alert is generated by XDR Analytics were detected. Reference Multiple Rare LOLBIN Process Executions by User • Cortex XDR Analytics Alert Reference

The source for this detection is data collected from the XDR Agent with Identity Analytics enabled. However, customers can take advantage of analytics network or identity detectors on a host in the absence of the XDR agent if additional network and identity data sources (Cloud Identity Engine, Azure etc.) are onboarded directly into Cortex XDR. 

For example, in addition to the agent, Cortex XDR can ingest PAN NGFW Enhanced application logs (EAL) and Third-party authentication service logs with the Pro GB or Cloud license to detect threats by collecting and analyzing cloud logs. Its analytics detectors examine cloud audit, flow, and identity logs to baseline behavior.

Reference 

Ingest Data from Next-Generation Firewall • Cortex XDR Pro Administrator Guide • Reader • Palo Alto ...

Visibility of Logs and Alerts from External Sources • Cortex XDR Pro Administrator Guide • Reader • ...

Analytics • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

To investigate, concerning the endpoint data collection gathered to stitch an alert, review the Debug alert data collected from the event for analysis:

Collect Debug data from Incidents Tab

1. Go To Incidents Tab and select the Incident that you want to Debug.
2. Alt+ Right Click on the Incident and select Download Debug Data

Collect Debug Alert data From Alerts page

1.  Go to the Alert and press Alt+ Right Click to select Debug Alert

2. It will open another window with Debug logs. Click on 'Copy Log' and view the logs for analysis.

If you found this answer helpful, please select Accept as Solution.

Thank you!