Hello @Yayati
Thanks for reaching out on LiveCommunity!
It tried to answer the questions provided by you. Please find below the answers.
During scan files are only scanned once. Thereafter files get scanned when they are executed. The purpose of scanning files again during execution is to reevaluate the verdict which may have changed since we scanned it last time.
Apart from the factors that you have mentioned, Machine learning based detectors and analytics are the avenues that help to analyze an activity. However if you want to have additional checks then you can use file metadata provided by XDR to check on various other open source avenues available.
Benign with low confidence settings provide you insight about how confident XDR is for the given verdict. For example, a file by a trusted signer or a file that was tested manually gets a high confidence Benign score, whereas a file that did not display any suspicious behavior at the time of testing gets a lower confidence Benign score. To add an additional verification method to such files, enable this setting. Then, when Cortex XDR receives a Benign Low Confidence verdict, the agent enforces the Malware Security profile settings you currently have in place (Run local analysis to determine the file verdict, Allow, or Block).
Settings->Configurations->Access management->Roles->Right click “Account Admin” and select “Save as new role”. Now you can modify the role as per your requirements and save it with a different name.
Once an endpoint is disconnected it will be in connection lost state for 30 days (default) and after 180 days the agent data is deleted. If an agent tries to connect to Cortex XDR during the 180 days period, the agent can resume connection and maintain its agent ID. After the 180 days period, the agent ID is deleted alongside all the associated data.
Cyserver service stops mostly for system restarts. Additinally administrator can stop it using cytool command “cytool runtime stop”.
XDR agent is assigned a default storage quota when it is installed. If this quota exceeds, XDR starts removing oldest data from its storage to make space for new data. You receive this log when the storage quota is full.
Once a scan is initiated, XDR do not scan files repeatedly even if the scan is interrupted. Next time when scan resumes, it will scan the remaining files on the system.
Please click Accept as Solution to acknowledge that the answer to your question has been provided.
... View more
