About Marsooq-Akkaradathil

Great thank you! Hope they add the new feature to block also domains if not URL with the host firewall. Till then if the customer also has Palo Alto firewalls maybe this is an option for the Cortex XDR to generate EDL lists that the Palo Alto firewall (Palo Alto Firewall and Cortex XDR integration) can consume:   https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/response-actions/manage-external-dynamic-lists.html   Also it is good to enable the firewalls access to the Cortex XDR and for the firewall to send its logs to the Cortex Data Lake so the Cortex XDR can see the network taffic:   https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/get-started-with-cortex-xdr-prevent/set-up-endpoint-protection/enable-access-to-cortex-xdr.html   https://www.paloaltonetworks.com/blog/2020/03/cortex-busted-by-cortex-xdr/ ... View more

I know this is an old question, but the way I've done this in the past is: Put the Portal and GW onto a loopback adapter Setup 2 NAT rules, 1 for each ISP, to forward GlobalProtect ports (443, 4501 etc) In the VR - ECMP setting, ensure you have Asynchronous return checked   ... View more

Thanks @QDSupportUser actually I didn't come up with the subject line that indicated MD5.  But the goal (via SHA256) was close.  Essentially was looking to have an Incident created from an alert named  Administrative Hash Exception, which seems to be by default set to LOW.  I was looking to make that an Incident.   So to restate here was looking to: add Hash to Block list, have Alert generated (done, this works 👍 ) Have that alert create an Incident (does not do that now 👎 , I believe because the Severity of the alert is set to Low) I also don't wish to have EVERY Low Sev alert become an Incident, just the "Administrative Hash Exception" alerts Hope that helps. ... View more

Hi @Marsooq-Akkaradathil-   You can view the results of the scan report in the Action Center.  Begin by going to Response > Action Center.    Within the All Actions list, locate your malware scan, right-click and select Additional Data.   If there were malicious files, they will show up here.  You can right-click and select View related alerts to see the malicious files and investigate deeper.      (Actual alerts below)     As far as the scan duration, I didn't see the full run time in the console.  You can, however, view this information from the agent by clicking on the scan tab.  I will check if a feature request has already been submitted for scan duration to be included from the console.  One more note on this -- the scans are not super fast by design.  The decision was made to allow the scans to run longer so that less system resources would be consumed.    Hope this helps.   ... View more

Hi @Marsooq-Akkaradathil -   I have not seen this issue.  To troubleshoot, have you tried modifying your agent profile to hide the agent icon.  Then, after checking in, modify the profile to show the icon again followed by one more check-in.  I'm just curious if this is a profile issue or agent issue.  ... View more

Hi @kiwi    i want to block one email address eg: sales@abc.com  as this email containing phishing urls. so i need to block the sender. can you explain how to block this email address and also the domain itself ... View more