Create Alert from Data Lookup

Hello everyone,
I have a reference dataset from IBM QRadar that I’ve stored as a lookup dataset. My goal is to create an alert if a malicious file is downloaded or opened. How can I achieve this or is it possible using BIOC?

Adding exception for weekend

Hey guys, I’m looking to exclude some detections that occurred over the weekends and could use a hand with crafting that query.

Cortex XDR Dataset - Total Days Stored

Hello All, 

Can anyone explain as to why a dataset that is a subset of the xdr_data dataset may have a total days stored value less than the xdr_data dataset? 

In my case the total days stored of the login_logs dataset is less than that of the pa

dashboard to view logins

What's up community!

I'm trying to create a dashboard in Cortex XDR that allows me to see user logins and log outs.

Is this possible with XQL? Or, for example, log when the endpoint was powered on.

I would greatly appreciate the help.

#cortex #cort

How to Deliver Upgrades to Endpoints with a Connection Lost Status

Dear Community,

I am encountering a challenge with the XDR agent upgrades. Although we distribute updates through the Action Center, agents in a "Connection Lost" state are not included as upgrade targets.

In our environment, some devices remain offl

Warning on malware profile being set to report only

Is anyone else seeing warning being generated on malware profiles and and their associated policies please?

For a couple of weeks, all of our Windows policies have been in a warning state. Investigating this we found that the malware profile was ge

Integrating Log Audit Management XDR / XSOAR

Dear Community,

Is there any documentation about how to integrate Audit Management XDR and XSOAR for a SIEM like Elastic? I need a centralized log audit for monitoring.

Thanks

Cortex scan report

Hello all,

I am a new user of Cortex XDR and I noticed that upon scanning a host, the malicious files identified by the scan are so difficult to find. I was expecting a proper scan report, where I can actually see the name and path of the identifie

XQL Query Assets XSOAR

Hi everyone,
I need your help.
I'm trying to create a CMDB using a playbook in Cortex XSOAR  , pulling data from the Cortex XDR tab Asset Inventory (XDR-managed devices as well as others collected via mappers and IoT firewalls).

My idea is collect all a