About fmoixsante

Hi there,   as @malalade stated the best course of action would be to open a case with support but not just for the so-called "XDRcleaner" but to find out why "tdevflt.sys" prevents you from uninstalling/upgrading the agent.   By the way, do you start the upgrade process from the XDR console? ... View more

Hi @Grady.Chen,    Like that it is not easy for anybody to provide a proper response to your question, I would recommend opening a case with TAC and provide the logs of the agent for further investigation. ... View more

Hi @EddieRowe ,   The auto-upgrade work in 3 ways.    You always upgrade to the latest version regardless of the version installed Latest agent release All agents will upgrade to the latest version published You always upgrade to the latest version of the version installed Only maintenance releases Each agent will upgrade to the latest maintenance version meaning, if you have 7.2.x, 7.3.x and 7.4.x, each version will upgrade to its latest released maintenance version. You only upgrade a specific version Only maintenance releases in a specific version This means that if you use this option, and you assigned it to a group of endpoints where there are different agent versions installed, you will only upgrade to the latest maintenance release of the specified version. The recommendation is to use "Latest maintenance version" and as long as you do not upgrade your agents to the latest version available, at the moment, 7.5, you should be fine.   ... View more

cytool reconnect force <distribution_id> is not really necessary when you delete an endpoint, and the endpoint is enabled as the endpoint is also less than 180 old. Just a normal checkin should suffice, which also means that as long as those machines have network access, most likely reconnected to your tenant with 5-10 minutes automatically. If those agents do not appear and normal checkin that doesn't work, you could do as @gjenkins recommended.    ... View more

Hi @AsifSid    Have those agent re-checkin again with the XDR console. ... View more

Hi @EddieRowe,   As far as I know, you would need to contact TAC support to get such a tool. ... View more

Hi @david.hernandez,   When adding Hash256 values to the Hash Allow List, either via Action Center's "Add to allow list ", or directly from the Incident's Key Artifact, or from the Casualty View, it will be added to the Hash Allow List. This list is then shared among all the XDR agents during the checkin process. If you have added a hash to the Hash Allow list, no further alerting should be generated.    Are you sure that you added the hash to the correct option? Which of the above-mentioned options did you use to add the hash to the allow list? ... View more

Hi @COGTeam ,   Welcome to the wonderful world of Cortex XDR.   The XDR tenant already has default profiles assigned to a policy rule per platform. I would suggest reading the admin guide on how to configure your own profiles and assign them to endpoints. Please refer to this article about profiles and this other article on how to apply them.   I would also recommend reading about Endpoint Groups.    ... View more

@PeteJacobCF, if the word password is not in the name, XDR/XQL will not be able to tell you that a file is not password protected. ... View more

@akshayhariRajan    You could create a BIOC for that file specifying a behavior and add that BIOC to a Restriction profile. ... View more

Hi @r_buchwalder ,   You can use the option "add to Allow/Block list". You can add up to 100 hashes. But you need to add the hashes one by one to the action task.   If you want to add them in a more automated way, you could use Cortex XDR API to accomplish this. Add to Allow List - API Add to Block List - API ... View more

Hi @aliCommunity,   First you would need if the Distro/Kernel of your server is supported. Please refer to this article.   Afterwards, please follow the installation steps outlined on Cortex XDR admin guide for Linux. ... View more