HELP - XQL QUERY For XDR and XSOAR

Hi,

I am creating a playbook with the objective of integrating Cortex XSOAR  and Cortex XDR . 

The idea is for Cortex XSOAR  to query Cortex XDR  , retrieve all the assets detected by the broker scanner, and verify which assets do or do not have the

Parsing at Broker VM level

I'm using COLLECT parsing rule to manipulate data at broker VM level before ingestion

 Rule basically filters out on raw log that I generate specific to my test like some log line that contains text criticalevent along with some date and random machi

Proofpoint TAP Integration - XQL Query Help

Has anyone worked with PP TAP integration and creating any useful XQL queries to help identify potential malicious mail that a user interacts with?  As example:
Email was not determined "bad" initially but after some sandbox from PP, it is later class

Linux RHEL kernel support isn't fast enough - problem

Query to detect any file/folder that are being hidden

Hi All,

Can someone please share the query to detect if any file or folder is being hidden?

Regards,

Shahwaz

Cortex XDR

Hello, Is there any possibility that the customer may utilize Cortex XDR agent in two domains, taking into account that first one has tenant id, the other doesn't?

Thank you in advance.

Unable to add multiple folders in exclusion list

Hi Team,

Am unable to add multiple folders under Exception configuration page. I have 20+ folders which i need to exclude in Cortex XDR, i went to Exception Configuration-->Disable Prevention policy-->Add Rule. I have to do this each every time for e

Remove enopoint XDR Cortex

Hi 

Can i remove XDR Agent from PC and i don*t have supervisor password for disable antitampering... 

Endpoint are not showing in XDR Console... 

please help, i have problems with cca 200pc

best regards...

Monitor and Collect Enhanced Endpoint Data in XDR

When setting the Agent profile in Cortex XDR, Under the check box when enabling "Monitor and Collect Enhanced Endpoint Data" is the following note:

Note: Before enabling enhanced endpoint data collection make sure your Strata Logging Service storage