About Daniel_Itenberg

Hi folks, got a problem that i would like som input on. I have an ubuntu endpoint with a xdr agent installed. said agent has given me a high severity alert about several items on this ubuntu endpoint - Kite(which, seeing how kite can install itself autonomously, i understand why the XDR would flag it), systemd and chrome. Now here's what i dont understand -  why would the XDR flag systemd? about chrome - the hash dosent appear on malware hash lookup services like talos and such, so im somewhat stumped.   Any Ideas on how I can verify it's a false positive or not?   thanks ... View more

Hi all, Im trying to set up encrypted communication to a syslog server from the XDR using a self signed certificate. However I cant seem to get it to work - the XDR says that no connection is available. I should note that without the certificate, on regular udp\tcp, everything works fine.   ... View more

Hi all, I have an ubuntu user which throws up malware alerts on a seemingly innocent ubuntu component - fixdep. I havent seen anything online about it being used in malicious activities , and it dosent show up on other ubuntu workstations.  Has anyone encountered this before? i am somewhat at a loss in this case ... View more

Hi all, I have a bit of a situation - I have a user that IT suspects is experiencing connection problems due ti the xdr agent. the user gets proxy error when opening chrome. However - His endpoint is not isolated, there are no quarantined files relating to network, nor is the firewall component of the xdr enabled on his endpoint(or at all). I suspect the issue is not related to the xdr but i'm not certain of it.  Has anyone encountered this before? are the connection problems related to the xdr?    any help will be appreciated  ... View more

Hi all, I am i need of assistance - how should I go about investigating an incident created by the "Failed Connections" alert?  I run malware scans on the host that raised the alarm, but what can I do beyond that? I should also mention that whenever such an incident arises, it is not accompanied by a malware alert or anything of the sort. ... View more

Hi all,  I have a question about the analytics engine - how long does it take for it to establish a baseline? I had it enabled yesterday and it started to give out alerts during the night, in the span of several hours.  seems like a rather short time to establish baselines, even based on data from only the agents installed on the endpoints. ... View more

Hi all,  Can the XDR auto delete files it has flagged, be it by local analysis or wildfire analysis? Or does it just block and quarantine files? ... View more

Hi all, question - can the XDR block a thunderbolt dock for macs? furthermore - all device control violations logged in the xdr main console, right? ... View more