Cortex XDR Discussions

Server reboot after Cortex XDR installation is required or not?

Hi,

I have one question regarding the Cortex XDR Agent installation, after i install the XDR agent in Servers (Linux or windows), do i need to reboot the server for the installation to take effect or no reboot needed? I am working in Telekom Malaysia

...

Resolved! Dynamic group "starts with"

Hi all,

I need to create a dynamic group based on the first letters of device name, like "starts with" or "not starts with".

I cannot use contains because, for example, I have server name that starts with QQ that should not be inside the group, but ser

...

Resolved! What is the manual repair snapshot in the repair suggestion?

I saw the following notice in the repair suggestion. It prompts me to repair it manually. It can't be found in the snapshot. What does this snapshot refer to? Snapshot of the system itself? Or can xdr do snapshots?

Resolved! HIPS and Host Firewall

I would like to know whether Cortex XDR has Host Intrusion Prevention and Host Firewall capability. If yes, what is the difference and how to enable.

Resolved! Report exporting questions

I have a custom timer filed called analysttimer, which recording the time analyst spend on an incident, once the incident this field will shows total time spend. I can see the total time is captured in the analysttimer.totalduration field.

When crea

...

Resolved! Behavioral Alert from Vulnerability Scanner - How to Allow Scans WITHOUT alerts from IP address?

We use an on-site vulnerability scanner that started triggering behavioral alerts on Cortex endpoints on Monday. These scans were disabled since they were very disruptive with some endpoints just reporting the issue and others blocking the scan. Al

...

XDR endpoints not scanning

Is there a way to look at only the endpoints that have not been scanned in certain amount of time?
I know I can view all the have been scanned in the last day/week/month etc, but I want to look at the devices that have NOT been scanned.
I need a "does

...

Resolved! Cortex XDR Agent rollout strategy

We will be rolling out to production soon and we need to have full AV protection while Cortex XDR is in monitor mode for up to 2 weeks. The previous Cylance AV agent must be uninstalled prior to the Cortex agent being installed so running in parallel

...

Log4j batch file execution

Hi All.

From the Palo alto advisory as per below, we have to run a batch file via our SCCM tool. But I need to understand what version of log4j we are using on our Cortex. How can we find out , Please help

To ensure you disable message lookup, follow

...

Use Cortex XDR to find host with ports 80,443 open

Hello -

I'm totally new to Cortex XDR and its XQL - though I need to find machines in our environment that have ports 80/433 open. Is this possible via XQL?

I started with these lines to see which column/s I could use for what I want to accomplish an

...

XDR install not connecting

After getting a Tech Coordinator to remove the old Traps version, she rebooted, and downloaded and installed XDR version 7.5 that I had sent to her. However it shows it is disabled and will not connect to the server. Any advice?

Resolved! Cortex Xdr Cytool Linux Force Reconnect

hi ,

I'm trying to create a Python script that I can run from management
to change the Installation Package value,
something like this;

import os

os.system('/opt/traps/bin/cytool reconnect force ecXXXXXXXXXXXX5efdbe920')

I was already able to create one li

...

XQL Query to identify Log4j impacted systems CVE-2021-44228

Hello

I am wanting to use XQL and file search to identify any effected machines. searching for files that contain the word log4j results in exceeding maximum results. Has any one developed a query for this yet thats more accurate?

Resolved! Best way to detect endpoints that do not yet have Cortex XDR Agent installed

Hey guys,

I am curious about if there is a way to find out which Endpoints in certain environment do not yet have XDR Agent installed.

I still two options, but had no practical experience in testing it:

1. Directory Sync with Cortex XDR. Would it dete

...

Resolved! Is it possible to search for Macros in Cortex?

Can Cortex see if macros have been launched on an endpoint, specifically Office Macros?

I tried the "All Actions" query and searched for .doc and .xls files but no luck.

Has anyone tried to search for macros using Cortex query or xql?

Just to clari

...

Discussions