The ‘Collect Forensic Data’ action with the ‘Process List’ option is a built-in, efficient method to gather comprehensive process details, including parent process, command line, and modules. It’s purpose-built for this forensic task, is less error-prone than manual commands, and is faster than writing a custom script.

Cortex XDR Local Analysis can both detect and block threats, but its behavior is controlled by the assigned prevention policy. If the policy is configured for ‘Detect’ mode, the agent will log the malicious activity but will not block it. The license type or console connectivity does not affect this core blocking capability once the policy is applied.

The Isolate action severely restricts network traffic but is designed to maintain crucial management connections. It allows communication with the Cortex XDR console (for command/control) and specifically configured internal remediation servers (for downloading tools, updates, or scripts). This balance contains the threat while enabling the response team to continue working on the endpoint.

A spike in exceptions indicates that allowed activities are deviating from policy. The first investigative step is to analyze the exception logs to understand the ‘who’ (user), ‘what’ (process), and ‘why’ (which security rule was bypassed). This context is essential to determine if the exceptions are legitimate (e.g., a new business application) or a sign of malicious activity evading detection. Taking action without this analysis is premature.

Using a mix of modes is optimal. Corporate laptops can use Direct Mode for simplicity. For contractor machines that may connect from various, untrusted networks, Forwarder Mode is ideal. The agent communicates with an on-premises Forwarder, which then talks to the Cortex cloud. This allows the agent to get updates from the Forwarder as soon as it establishes any connection to the corporate network, without requiring direct internet access from potentially restricted environments.

The alert name ‘cred_llmr_attack’ is a Cortex XDR BIOC (Behavioral Threat Indicator) specifically related to credential access. ‘LLMR’ refers to tools and techniques (like Mimikatz) that target the LSASS process memory to extract hashes and plaintext passwords. This is a classic post-exploitation activity following an initial breach.

The ‘Malware Analysis’ section of the RCA provides deep technical details about the malicious artifact itself. It would include behavioral analysis, such as the specific code injection method used (process hollowing), along with other forensic evidence like file hashes, registry modifications, and network calls made by the malware. The MITRE section would categorize the technique (e.g., T1055), but the Malware Analysis section provides the proof.

On macOS, ‘Full Disk Access’ is the critical System Extension permission that allows the Cortex XDR agent to monitor all file system activity and take actions like reading, deleting, or moving (quarantining) files anywhere on the disk. Without this permission, the agent’s prevention and remediation capabilities are severely limited.

A Query List allows you to save a specific XQL query and its results as a reusable, named list (e.g., ‘Endpoints_with_Vulnerable_App_v1.2’). This list can then be referenced within other, larger XQL queries using the `in` or `contains` operators, promoting modularity, reusability, and consistency across investigations.

The ‘Collect Forensic Data’ action with the ‘Process List’ option is a built-in, efficient method to gather comprehensive process details, including parent process, command line, and modules. It’s purpose-built for this forensic task, is less error-prone than manual commands, and is faster than writing a custom script.0