About MithunKT

MithunKT · ‎01-03-2023

Hi @neelrohit , I just wanted to thank you for your lightning-fast response to my query. The solution you provided was not only effective but also incredibly well-described. I really appreciate the effort you put into helping me out. Your assistance is greatly appreciated.

MithunKT · ‎01-03-2023

Hi All, We have configured periodic endpoint scanning in all the malware profiles in our infrastructure. We needed to get the scanning report, or at the very least, the scan's status, such as how many systems got scanned or failed. How and where can I obtain this information? Thank you!! Cortex XDR

MithunKT · ‎11-10-2022

Hi All, We have a requirement to get cortex XDR Data(Alerts, agent audit logs) into IBM Qradar. Following the documentation, we took the approach of configuring syslog server in external applications, new configuration in notifications, and adding Cortex DSM app extension in QRadar. Due to security concerns, our QRadar team does not wish to make our syslog server's private IP address public. A public IP is required in order to add a Syslog server to External Applications, according to the XDR documentation. We lack a public IP, hence we are unable to use this strategy. As a result, I was searching for a different way to send XDR alerts to the Qradar Syslog Server (perhaps using an API). If anyone has any alternative suggestions, I'd appreciate it. Thanks in Advance. Cortex XDR

MithunKT · ‎10-26-2022

Hi @neelrohit I appreciate for giving me the XQL query; it works great. But now I'm having trouble exporting the results (1000000 results). I would like to have these findings in tsv or spreadsheet format, but I cannot do so as it takes a lot of time, and after some time download goes to an error state. Would you like to suggest a different method for exporting these results into a tsv or excel file? Thanks!! Cortex XDR

MithunKT · ‎10-25-2022

Hi All, Can someone tell me how do we query all event logs for a particular hostname using XQL ? Thanks!! Cortex XDR

MithunKT · ‎10-09-2022

Hi All, We have a Broker VM set up in our environment, and we only want the agents to communicate with the tenants through the Broker. However, we are seeing few endpoints talking to the Tenant directly over the internet. Although "proxy" is specified for all of these endpoints, the "last used proxy" field is empty for a few endpoints. Is there a way to force communication through the broker even if the endpoint has an internet connection? Also, please let me know the command needed to set a proxy using Cytool on Linux as well. Thanks

MithunKT · ‎08-26-2022

Hi @creddy Even we too facing this issue. Alert name: Wildfire malware Category: Malware Module: WildFire post detection Files are identified as malware, only to be analyzed in WildFire and come back as benign, these files remain as verdict "Malware". Is it possible to explain "wildfire post detection" module logic ? Thanks

MithunKT · ‎08-20-2022

Hi All, Is it a good idea to enable the XDR host firewall to manage all endpoint communication? or is it better to keep the default windows firewall enabled without using the XDR firewall? I would be happier if someone suggests any article/documentation links which show a comparison between the XDR firewall and windows firewall in terms of features. As per my understanding, the XDR firewall is better than the windows firewall but managing firewall rules is a bit difficult as it doesn't come with any default rules like the windows firewall. Please correct me if I'm wrong. what would be the best approach to tackling this situation? Thanks in Advance!! Cortex XDR

MithunKT · ‎08-16-2022

Hi All, Can anyone let me know how to check the content update version at the endpoint level? It is not visible in the agent console. Can I make use of Cytool? If yes, what is the command to check? Thanks! Cortex XDR

MithunKT · ‎07-29-2022

Hi @bbarmanroy it was for analysis and Investigation purposes. We got an incident from Analytics alert source stating internal scanning was observed, on checking the alert data we found multiple failed network connections from a single host towards multiple internal Destinations. We just wanted to pass on this data (List of destinations, protocols) everything to the network team but exporting option was not available. So how do we export the data in these scenarios? We can't give access to the XDR console to our network team but they should be given alert data in csv or tsv format. Thanks!!

MithunKT · ‎07-28-2022

Hi All, Is there a way to export all the alert data which appears below Causality chain like network connections, registry changes, etc ? I don't see any download or export icon on the right-hand side of the pane. Do we have any other way to export these data? Thanks!! Cortex XDR Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

MithunKT · ‎07-25-2022

Hi @bbarmanroy , Even I'm having the similar requirement to allow hash for specific endpoints. But as per my observation, the Malware profile allows only to add files/folders/trusted signers into allow list. I don't see any fields where I can add hashes. We have a scenario here where we need to allow the execution of a particular internal tool that has no signers and can be found in different file paths with different end users. Therefore I can whitelist neither trusted signers nor files/folders. I need to allow the only hash to this specific group of people. Unfortunately, that option is unavailable. Thanks!!

MithunKT · ‎07-25-2022

Hi @creddy There is no proxy server placed between agent and XDR tenant communication. I too investigated from the user end to find out what actually is creating duplicate entries. I found out the below reasons; 1) whenever multiple users login to the same endpoint(Shared host) then duplicate entries are created. 2) whenever the same user connects from different IPs(VPN, office network) then duplicate entries are created for the same endpoint. I just wanted to understand Is this the natural behavior of XDR creating duplicate entries for the same endpoint whenever user authority or IP changes? If so; How licensing will be affected for these duplicate entries? How do we clean up the unnecessary duplicates automatically? Thanks!!

MithunKT · ‎07-24-2022

Hey @MarvinC I have tried creating a custom widget and I'm getting report of duplicate entries every day. But how do you remove the entries which are not needed? I have tried the "delete endpoint" option, it will remove the entry from the "All endpoints" but in the next day's report, it will reappear again. What's the best solution to clean up all these unnecessary entries permanently?

MithunKT · ‎07-22-2022

Hi All, We have started noticing duplicate endpoint entries in the "All Endpoints" section. After checking all the fields we found that there are different endpoint_ids for the same endpoint name. What could be the reason behind the creation of these multiple/duplicate entries and how can we clean up these entries? Thanks!!

Member Since	‎06-14-2022 10:09 PM
Date Last Visited	‎04-19-2023 01:57 PM
Posts	18
Total Likes Received	3

Online Status	Offline
Date Last Visited	‎04-19-2023 01:57 PM

About MithunKT

Re: Periodic Endpoint Scanning Report

Periodic Endpoint Scanning Report

Cortex XDR integration with IBM QRadar

Re: XQL Query - Event logs of a particular host

XQL Query - Event logs of a particular host

Routing traffic towards Broker VM

Re: Cortex XDR blocking TeamViewer again....

Which one is better between cortex XDR host firewall and windows firewall ?

Checking Content update version in endpoint(Cytool)

Re: Exporting alert related data

Re: Periodic Endpoint Scanning Report

Re: Cortex XDR-File hash Allow/Block on specific endpoint

Re: Cortex XDR blocking TeamViewer again....

Re: Periodic Endpoint Scanning Report

Re: Which one is better between cortex XDR host firewall and windows firewall ?

Re: Which one is better between cortex XDR host firewall and windows firewall ?

Re: Cortex XDR-File hash Allow/Block on specific endpoint

Re: Cortex XDR blocking TeamViewer again....

Re: Periodic Endpoint Scanning Report

Periodic Endpoint Scanning Report

Cortex XDR integration with IBM QRadar

Re: XQL Query - Event logs of a particular host

XQL Query - Event logs of a particular host

Routing traffic towards Broker VM

Re: Cortex XDR blocking TeamViewer again....

Which one is better between cortex XDR host firewall and windows firewall ?

Checking Content update version in endpoint(Cytool)

Re: Exporting alert related data

Exporting alert related data

Re: Cortex XDR-File hash Allow/Block on specific endpoint

Re: Duplicate endpoint entries observed

Re: Duplicate endpoint entries observed

Duplicate endpoint entries observed