Endpoint security using Cortex XDR - Revision history

AAmmann: /* Used Hardware */

2023-02-03T16:56:17Z

Used Hardware

← Older revision		Revision as of 16:56, 3 February 2023
Line 139:		Line 139:
	== Used Hardware ==		== Used Hardware ==

	HP Notebook		Notebook

	== Used Software ==		== Used Software ==

AAmmann: /* Execution Phase */

2023-02-03T16:56:07Z

Execution Phase

← Older revision		Revision as of 16:56, 3 February 2023
Line 135:		Line 135:
	=== Execution Phase ===		=== Execution Phase ===

	We executed the WannaCry and Cerber Ransomware on our Endpoint where the Agent was installed. The Agent blocked the executions and uploaded the data to a webUI. On the WebUI, we were able to analyse the blocked attack and view the processes which would have been generated on a Sandbox called Wildfire		We executed the WannaCry and Cerber Ransomware on our Endpoint where the Agent was installed. The Agent blocked the executions and uploaded the data to a webUI. On the WebUI, we were able to analyse the blocked attack and view the processes which would have been generated on a Sandbox called Wildfire.

	== Used Hardware ==		== Used Hardware ==

AAmmann: /* Execution Phase */

2023-02-03T16:55:54Z

Execution Phase

← Older revision		Revision as of 16:55, 3 February 2023
Line 135:		Line 135:
	=== Execution Phase ===		=== Execution Phase ===

	We executed the WannaCry and Cerber Ransomware on our Endpoint where the Agent was installed. The Agent blocked the executions and uploaded the data to a webUI. On the WebUI, we were able to		We executed the WannaCry and Cerber Ransomware on our Endpoint where the Agent was installed. The Agent blocked the executions and uploaded the data to a webUI. On the WebUI, we were able to analyse the blocked attack and view the processes which would have been generated on a Sandbox called Wildfire

	== Used Hardware ==		== Used Hardware ==

AAmmann: /* Pentesting With Cortex XDR */

2023-02-03T16:54:41Z

Pentesting With Cortex XDR

← Older revision		Revision as of 16:54, 3 February 2023
Line 132:		Line 132:

	For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.		For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

			=== Execution Phase ===

			We executed the WannaCry and Cerber Ransomware on our Endpoint where the Agent was installed. The Agent blocked the executions and uploaded the data to a webUI. On the WebUI, we were able to

	== Used Hardware ==		== Used Hardware ==

AAmmann: /* Installation */

2023-02-03T16:51:46Z

Installation

FPaschinger: /* Pentesting With Cortex XDR */

2023-02-03T16:50:23Z

Pentesting With Cortex XDR

← Older revision		Revision as of 16:50, 3 February 2023
Line 112:		Line 112:
	# Select the Package Type.		# Select the Package Type.

	##Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.		###Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

	##Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.		##Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

AAmmann: /* Pentesting With Cortex XDR */

2023-02-03T16:49:46Z

Pentesting With Cortex XDR

← Older revision		Revision as of 16:49, 3 February 2023
Line 112:		Line 112:
	# Select the Package Type.		# Select the Package Type.

	#*Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.		##Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

	#*Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.		##Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

	#*(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.		##(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

	#*Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.		##Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

	# Specify the installation package settings.		# Specify the installation package settings.

AAmmann: /* Pentesting With Cortex XDR */

2023-02-03T16:48:12Z

Pentesting With Cortex XDR

← Older revision		Revision as of 16:48, 3 February 2023
Line 112:		Line 112:
	# Select the Package Type.		# Select the Package Type.

	*Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.		#*Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

	*Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.		#*Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

	*(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.		#*(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

	*Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.		#*Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

	# Specify the installation package settings.		# Specify the installation package settings.
Line 127:		Line 127:

	When the status of the package shows Completed, right-click the agent version, and click Download.		When the status of the package shows Completed, right-click the agent version, and click Download.
	*For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.		#*For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

	*For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.		#*For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

	*For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.		#*For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

	== Used Hardware ==		== Used Hardware ==

FPaschinger: /* Pentesting With Cortex XDR */

2023-02-03T16:47:37Z

Pentesting With Cortex XDR

← Older revision		Revision as of 16:47, 3 February 2023
Line 104:		Line 104:
	It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.		It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
	==Pentesting With Cortex XDR ==		==Pentesting With Cortex XDR ==

			=== Installation ===

	# From Cortex XDR, select Endpoints → Agent Installations.		# From Cortex XDR, select Endpoints → Agent Installations.

AAmmann: /* Pentesting With Cortex XDR */

2023-02-03T16:46:53Z

Pentesting With Cortex XDR

← Older revision		Revision as of 16:46, 3 February 2023
Line 105:		Line 105:
	==Pentesting With Cortex XDR ==		==Pentesting With Cortex XDR ==

	1- From Cortex XDR, select Endpoints → Agent Installations.		# From Cortex XDR, select Endpoints → Agent Installations.
	2- Create a new installation package.		# Create a new installation package.
	3- Enter a unique Name and an optional Description to identify the installation package.		# Enter a unique Name and an optional Description to identify the installation package.
	4- Select the Package Type.		# Select the Package Type.

	*Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.		*Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.
Line 118:		Line 118:
	*Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.		*Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

	5- Specify the installation package settings.		# Specify the installation package settings.
	6- Create the installation package.		# Create the installation package.

	Cortex XDR prepares your installation package and makes it available on the Agent Installations page.		Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
	7-Download your installation package.		# Download your installation package.

	When the status of the package shows Completed, right-click the agent version, and click Download.		When the status of the package shows Completed, right-click the agent version, and click Download.

← Older revision		Revision as of 16:51, 3 February 2023
Line 107:		Line 107:
	=== Installation ===		=== Installation ===

	# From Cortex XDR, select Endpoints → Agent Installations.		From Cortex XDR, select Endpoints → Agent Installations.
	# Create a new installation package.		Create a new installation package.
	# Enter a unique Name and an optional Description to identify the installation package.		Enter a unique Name and an optional Description to identify the installation package.
	# Select the Package Type.		Select the Package Type.

	~~###~~Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.		Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

	##Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.		Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

	##(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.		(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

	##Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.		Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

	# Specify the installation package settings.		Specify the installation package settings.
	# Create the installation package.		Create the installation package.

	Cortex XDR prepares your installation package and makes it available on the Agent Installations page.		Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
	# Download your installation package.		Download your installation package.

	When the status of the package shows Completed, right-click the agent version, and click Download.		When the status of the package shows Completed, right-click the agent version, and click Download.
	#*For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.		For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

	#*For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.		For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

	#*For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.		For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

	== Used Hardware ==		== Used Hardware ==