Cortex Cloud: Receiving "Unsupported" Errors for ADS scanning
201
Created On 09/30/26 20:22 PM - Last Modified 09/30/26 20:35 PM
Question
When running XQL for ADS scanning, what is "Unsupported" need more verbosity?
dataset = cloud_health_auditing
|filter capability = "ADS"
filter (classification contains
'"Unsupported") Example of some errors below:
| Unsupported | Error description |
|---|---|
| Unsupported Architecture | Host architecture is not x86-64 and is currently unsupported |
| Unsupported | The disk filesystem is unsupported |
| Unsupported Asset Size | Asset size exceeds the maximum supported size for scanning |
| VM Disk Image not scanned | Image must be owned by the monitored account |
| Marketplace Error | AWS Marketplace AMIs are currently unsupported in Cloud Scan mode |
Environment
- Cortex Cloud
Answer
What exactly is "Unsupported" for ADS scanning within Cortex Cloud. Please define.
| Unsupported | Error description | More Verbosity |
|---|---|---|
| Unsupported Architecture | Host architecture is not x86-64 and is currently unsupported | Cortex Cloud can't scan the EBS root volume if it is ephemeral |
| Unsupported | The disk filesystem is unsupported | Mac filesystems are not supported |
| Unsupported Asset Size | Asset size exceeds the maximum supported size for scanning | Cortex Cloud scans assets up to 1024GB disk size |
| VM Disk Image not scanned | Image must be owned by the monitored account | Cortex Cloud only scans images from owner account |
| Marketplace Error | AWS Marketplace AMIs are currently unsupported in Cloud Scan mode | Cortex Cloud AMI marketplace images as it requires additional permissions blocked by AWS |
Additional Information
Errors can vary from tenant to tenant these are just some examples Unsupported ADS scanning errors. What Cortex Cloud supports is subject to change based on new releases. Please refer to our release documentation here.