About AsifSid

Hi All,   Does any one have a sample template or document for Cortex alert /incident managment procedure.     Regards Asif Siddiqui ... View more

Hi All   We are receiving large number of alerts in our cortex xdr console, The alert is as below, (hostname and user name I have kept as XYZ for privacy)   'Kernel Privilege Escalation' generated by XDR Agent detected on host XYZ involving user XYZ"   In all the alerts the process involved is "java."   I need to understand this alert and the steps to be followed next.   Please share you knowledge on this.     Thanks & Regards Asif Siddiqui ... View more

Hi All,   I have come across a situation, where I am unable to remove traps agent from a windows systems, Below are the findings from this situations. 1) This perticular windows endpoint is unlicensed now meaning there is no communication between this endpoint and traps ESM server. 2) We tried removing traps using traps cleaner tool but while running this tool it says "SPROT is enabled please enter password to disabled it" 3) When we enter the password it says incorrect password (we know pssword is correct" 4)When we try to remove traps through control panel , it asks for the password and hence not accpeting the password. 5) We tried to install traps by overrighting the current installation. but during the traps setup window, The ESM server name and port number comes already hardcoded means we cant change the things which are already there.  6) This unlicensed traps is blocking a perticular pdf on the system, so evenif i whielist that pdf , those changes will not take effect untill the communication is established.   I have opened a ticket with support people, but still if anyone has any clue , Please assist.     Regards Asif Siddiqui ... View more

Hi All,   I am unable to access security event tab (also policies tab) in traps console. I am getting message as below, "Oops.. Something went wrong, Please contact your system adminstartor"   Note:My role is defined as super user in console. ... View more