About Chilla

Dear community, I would like to block connections to specific domains using BIOC, but I found that the "Add to restrictions profile" button is missing when right-clicking on a BIOC rule. Why is there no such button? Alternatively, is there any way to block specific domains using XDR? ... View more

Dear  community, I tried to make some agents connect directly to the server without using a broker.  However, it's not able not connect to server. I referred to the practices of others, and tried executing " cytool reconnect force",  but still couldn't establish a connection.  Because some endpoints can be successfully connected, it can be ruled out that the firewall is blocking the connection.   After checking the traps.log, I noticed that the logs do not mention FQDN. Is this normal?   Furthermore, the broker has been confirmed to be offline, but it appears that it is still attempting to connect to the broker and showing a "connect timed out" error.   Upon checking the "All endpoints" section, it seems that the proxy field still contains the broker IP. Could this be related to the issue? But why is it that some endpoints can still connect directly to the server, even though the proxy field still contains a record?   thx for any help. ... View more

Hello everyone! Recently, I have been learning about the Identity Analytics feature in Cortex XDR. After enabling Identity Analytics, I found that not every tenant presents the same interface. I found that the following UI features are not identical: absence of a Risk Management Dashboard less information displayed in User Risk View (e.g.  Regular Activity Hours artifact info,  Actual activity...)   no Asset Roles Configuration(Asset → Asset Roles Configuration). no Host Risk View I checked some official documents, it seems to be caused by the Identity Threat Module not being enabled.     I’m a little confused about a few points： So enabled Identity Analytic does not represent the Identity Threat Module is enabled? To fully enable the Identity Threat Module, we not only need to enable Identity Analytics in Cortex XDR but also need to activate the Cloud Identity Engine, right? About Risk Management Dash Board, I check the document about Metrics Widgets. Regarding the description of ＂Top 5 Users at Risk＂ and ＂Watchlist＂ in Widgets, both are about users who are most vulnerable to potential security threats. I would like to know more about the differences between them. In User Risk Card,  ＂Login Attempts＂ and ＂ Latest Authentication Attempts＂, i t seems that both display login information, including src_ip, dst_ip, and vendor. I would like to ask for more information about the differences between the two. Perhaps someone can help me clarify the above questions. Thank you all. 🙏 ... View more