About nsinghvirk

Hello @JosipS    Thanks for reaching out on LiveCommunity! Please raise a TAC case because the alert data needs to be analysed to determine the root cause. TAC team will be able to help you to troubleshoot the issue.  ... View more

Hello @EnriqueSanz ,   For better search, please bookmark below link for XDR admin guide and in future search within it for your queries. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Overview   Regarding the query, please ensure that you are using same time period in your XQL query and in the interface. ... View more

Hello @tgeorgebabu ,   Thanks for reaching out on LiveCommunity! In order to get information about application inventory, you need to have "Host Insight" add-on license. If you have the license then you can navigate to Incident Response -> Host Inventory -> Applications. This will open a table which contains applications along with their versions. This will also show their vulnerabilities with CVE numbers. You can also query "host_inventory_applications" preset to query application specific details like installation details, version or version etc. Unfortunately , XDR cannot provide you details about the application owner. ... View more

Hello @EnriqueSanz ,   Thanks for reaching out on LiveCommunity! Please take reference from below XQL query to create your BIOC rule. This query simply detect remote port 22 on a particular host.  dataset = xdr_data | filter event_type = NETWORK and action_remote_port = 22 and agent_hostname = "<hostname>"   You can add your use case requirements to it. Below are the links to XQL and BIOC guides. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Get-Started-with-XQL https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-with-BIOCs   Please let us know which documentation links are broken so that we can repair them or provide you updated ones. ... View more

Hello @PC-TomS    Thanks for reaching out on Live Community! There are few pointers we need to clarify before we can suggest some solution. 1. Do you have enough number of Host Insight licenses? Since Host insight is an add-on separate from pro license, many times it happen that customer do not buy equal number licenses as compare to their pro licenses. So host insight will only work for the number of endpoints  for which add-on was bought. 2. Please verify if Host Insight was enabled for all the endpoints. When we have multiple profiles, it can happen that we may miss out on some profiles for which host insight capability was not enabled. Please ensure that all the profiles for which you want to enable host insight, you go to the agent setting profile and then first enable the pro capabilities(Disabled by default) and then enable host insight capability(Enabled by default) along with the sub menu for Endpoint Information Collection. 3. Please follow below document to verify if your endpoints meet the requirement for vulnerability assessment. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Vulnerability-Assessment?tocId=1asxAZOcVriCZCDhfe0jQQ ... View more

Hello @Shashanksinha    Thanks for reaching out on Live Community! The severity of an incident is govern by the severity of alerts in it. Incident will have the same severity as of the highest severity alert in it. For the alert side, severity depends on the type of alert it is. BIOC/IOC alerts will have the severity that was configured in them when those rules were created. For alerts from 3rd party integration, the severity will be same as was forwarded by the integrated product. You can refer to below document to see the severity of analytics alerts https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference   Unfortunately there is no consolidated document to show how the severity works for all kind of alerts. ... View more

Hello @AshokBabu ,   Thanks for reaching out on Live Community! Yes, you can create a correlation rule in order to generate alert for your use case. You can use custom dataset/lookup. It need not to be multi source in order for the correlation rule to work. Below are some points to remember when writing correlation rule. 1. The XQL features for  transaction ,  call ,  top , and wildcards in datasets ( dataset in (<dataset prefix>_*) ) are not currently supported in Correlation Rules. If you add them to the XQL definition, you will not be able to Create or Save the Correlation Rule. 2. Using the current_time() function in your XQL query for a correlation rule can yield unexpected results when there are lags or during downtime. This happens if the correlation rule doesn’t run exactly at the time of the data inside the timeframe, for example when a rule is dependent on another rule, or when a rule is stuck due to an error, and then runs in recovery mode. Instead, we recommend using the time_frame_end() function, which returns the timestamp at the end of the time frame in which the rule is executed.   ... View more