Application Severity Score

Hi, I noticed a "Severity Score" in Applications under Host Inventory but there doesn't seem to be any scoring happening. Is this apart of a license we may not have or does this not function the way I would imagine? I assumed maybe CVEs for applicati

Behavioral Threat Rule inject_rwx_module_to_long_live

Does anyone know what the following behavioral rule means in Cortex XDR 

        "alert_description": "Behavioral threat detected (rule: inject_rwx_module_to_long_live)",

I can't find it anywhere in PaloAlto documentation or anywhere else on the forums

Can/Does cortex XDR agent perform real time scan on drives responsible for "Live" video streaming?

After we got cortex XDR installed, some of the endpoints intermittently freeze during live video streaming. So wanted to understand if XDR does real time scanning on these drives

AWS tags in the Cloud info field?

We have hundreds of AWS assets with lots of information in Cloud Info, but none have anything in the tags field.

Has anyone else seen (not seen) this?

Just to clarify, I am not talking about Cortex XDR tags.

Thanks

User details

Hi Team,

Can we check user details on the XDR console - Local user with admin privileges?

Any way to identify such users?

Regards,

Shahwaz

XDR on Linux Appliances

Hi All,

Can XDR be installed on these servers -

• Checkpoint
• Force Point DLP Protector
• Cisco Expressway
• Trend Micro - Smart Protection
• Z Scaller Application
• Trellix-NDLP

Thanks,

Shahwaz

jusched.exe flagged as Threat by Behavioural Threat Protection

We are flooded by alerts from jusched.exe being flagged as Threat by Behavioural Threat Protection.

Are exclusions the only way out to resolve?

Show results only with matching fields from two different queries

I am trying to combine the results from two queries, one using dataset=xdr_data and one from preset=xdr_file. But, I only want to see the results when the same "agent_hostname" appears in both queries. In other words IF agent_hostname from filtered x

XDR AV Scan Alerts/Incidents

Hello Team,

During AV scan, everytime we are recieving cache file is detected from the different hosts and filename and Hash is same. The file verdict is Benign.

Help me how can I address this file. As it is a temporary file.

Your Cortex Data Lake integration with Cortex XDR is about to expire

We received a Cortex XDR email with the message:

"Your Cortex Data Lake integration with Cortex XDR is about to expire. To avoid any data loss, it is recommended that you copy your device configurations directly into Cortex XDR"

There was also a si

Cortex XDR Error Pop-Up in Mac

Hello Team,

We have already granted full disk permissions in macOS for Cortex XDR. However, we are still encountering the following popup:

The popup continues to reappear on the machine.

Not able to define new uninstall password

Our XDR agent uninstall password suddenly became unusable. So i figured i would go in and set a new one. Turns out it won't allow me to set a new password. It says: "Does not meet the requirements".

I have set the password to be 20 charachters, i hav

Cortex XDR Error Pop-Up in Mac

Hi Team,

We have already granted full disk permissions in macOS for Cortex XDR. However, we are still encountering the following popup:

The popup continues to reappear on the machine.