Hello,
I am sending Cisco Asa logs to Cortex XDR and XDR automatically creates parsing rule of "Ingest". When I am searching for "cisco_asa_rules" in query, I got a field named "raw" which contains detailed format of log:
That is a detailed for
...
Hey community,
I'm curious if anyone's had experience with integrating AMSI with Sharepoint servers and how Cortex XDR works into all of that. I am curious also, if AMSI needs to be enabled or if it's recommended to be disabled. Any current configu
...
Hi,
I want to query a specific number of events between 2 dates.
I have this query below, but it is missing the "between current_date and last 5 minutes"
dataset = fortinet_fortiauthenticator_vm_raw | filter deviceSeverity != "information" | filt...
Hi all, we are observing this behaviour on some domain controllers where xdr agents losing connection to tenant and the only way-out is to remove them via xdr cleaner and reinstall, only to fail again in a bunch of days.
We are out of ideas, obviousl
...
Hello, If I ask, can you please answer to this question?
The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to
...
I noticed that Cortex XDR 3.9 includes something called a "UEFI protection module". Here is the description from the release notes:
"Cortex XDR has expanded its malware protection capabilities by adding the UEFI protection module, which reinforces
...
Hi Team,
Can someone please let us know the XDR and Broker VM architecture?
Regards,
SHahwaz
Hi all, I have an issue that started popping up with an agent installation - newly installed agents throw out a 307 error. the package is present on the xdr management console, and we are beneath the license limit.
What can be the issue here?
Hi, I need help, I have Cortex XDR policy to allow scans on the endpoint, however users are unable to start the scans, the option does not appear
I can only scan, with cmd as administrator (cytool scan start) , in the GUI I can't even do it as admini
...
Hello,
I am currently trying to create a five depth process tree to perform long tail analysis on it.
The query in KQL language can be found here
The moment I perform the first join statement everything breaks
Here is the almost complete code but you ca
Hi,
After upgrading Cortex XDR agent to version 8.2.1.47908 , one of our servers suffer massive memory usage by multiple Cortex XDR Local Analysis Worker processes (8x2GB=16GB RAM). After restarting the Cortex agent, memory is freed for a while, but
...
Hi,
Does Cortex malware scans e-mails inside Outlook mailbox and if not, is it possible to do this?
Hi team,
I created cluster from scratch and added here 2 brokervm, then for new cluster I assigned dedicated IP address and FQDN, then in local DNS is created A record using ha cluster FQDN and dedicated IP address. Is ti true way? because I tried
...
Hi family ,
I want to update the windows version on some endpoints through command line or powershell script, which i can access by cortex xdr live terminal.
Is it possible?
Cortex XDR
