About afurze

Hi Rdesjardins,   Unfortunately, the license duplication issue is simply unavoidable in your situation, in the same way as license duplication would be seen when a physical desktop or laptop is re-imaged.  I would encourage you to reach out to your account team to determine what capacity you have in your current licensing and any potential options to address your unique situation. ... View more

Hi AnupamaD,   If you want to query raw logs outside of an incident or alert context, you can use the Query Builder (Incident Response -> Query Builder).  You can pick one of the 'wizard' style query builders, Basic, Identity, Endpoint, Network, or Cloud, which all search using the Cortex Data Model.  If you want to write more complex queries or have more control over filtering and such, you can construct your own queries using XQL, either against a specific dataset, or, more commonly, using the same data model. ... View more

Hi AnupamaD.   Can you please clarify, what do you mean by "locating the raw log"?  Are you asking how to query log data that you are bringing in to XSIAM? ... View more

Hi Tlmarques,   Using standard Windows cmd syntax, you can redirect stdout to a file via the '>' character after the command followed by a filename.   cytool firewall show > C:\firewall_output.txt ... View more

Hi Venkatesh_Konar,   Just to add on to what @abdrahman already said, if the file was also quarantined in addition to being blocked, the action will be reported as Prevented (quarantined), but whether this is done is based on your Malware Profile configuration.  Note, XDR does not automatically delete files, only optionally quarantine them.   Correction, this is not shown as a part of the alert action information.  You can confirm this by going to the Action Center and clicking on File Quarantine to see the list of currently quarantined files on all endpoints. ... View more

Hi Ashok.Shau,   For coverage assessment requests, please submit a TAC case with all relevant information including any available POC code. ... View more

Hi RamyashreeMada,   Unfortunately, the Threat Vault link provided by @abdrahman is only applicable for our NGFW solution.  For Cortex XDR coverage information, please submit a TAC case. ... View more

Hi SeanDeHarris,   Just to add some additional color on this, you will not miss any attacks or decrease your protection capabilities by not purchasing the new XTH module.  The vast majority of analytics alerts will still work, and those that do not are being actively evaluated by our research and product teams to determine if any changes can be made to ensure they work with the data uploaded by the new base Pro EP offering.   The goal of splitting out some EDR data collection is to keep our existing protection and detection capabilities largely intact while reducing the bandwidth consumption for customers that don't want or need the detailed log collection for threat hunting.  You will, of course, get all relevant data uploaded when an alert is triggered on the agent, but the real-time data uploading is more limited otherwise.     I would recommend you reach out to your account team for detailed information on what events are and are not collected without the XTH license, and to have an additional discussion around how we are continuing to provide the same great detection and response capabilities regardless of your licensing. ... View more

Ah, understood.  In this case, the documentation is referring to the data coming from the Management API and Graph API.  I'll have to refer you to Microsoft to see exactly what is in those APIs, however, they generally contain audit events for various Microsoft 365 apps, as well as Azure AD itself, plus any alerts that are generated by Microsoft security products like Azure AD Identity Protection, and the various Defender products (including endpoint).  Depending on which products you select when setting up the integration within Cortex XDR, you can elect to receive audit data from SharePoint, Exchange, DLP as well as general M365 and Azure AD audit logs. ... View more

Can you please clarify what you mean by "data"?  We have already identified that XDR can ingest the alerts, but not the raw EDR logs from Defender, I'm not sure what other data you're referring to. ... View more