topic Re: Different process exception on Exception Profile and Folder Allow List on Malware profile in Cortex XDR Discussions

Different process exception on Exception Profile and Folder Allow List on Malware profile

Muhammad-Rusli — Tue, 24 Aug 2021 15:30:24 GMT

Hi Expert,

Please give me advice, So I have assesment for exclusion folder and file .exe and file etc extension.

The asessment from Sophos for agent existing my customer.

The example exclusion files like a below :

C:\Windows\System32\backgroundTaskHost.exe

C:\Program FIles (x86)\Microsoft SQL Server\

*.txt

, more again

So my question is, where I can add the exclusion folder/files, Malware Profile or Exception Profile?

Re: Different process exception on Exception Profile and Folder Allow List on Malware profile

yalonso — Thu, 26 Aug 2021 20:01:10 GMT

@Muhammad-Rusli wrote:
Hi Expert,

Please give me advice, So I have assesment for exclusion folder and file .exe and file etc extension.
The asessment from Sophos for agent existing my customer.

The example exclusion files like a below :

C:\Windows\System32\backgroundTaskHost.exe
C:\Program FIles (x86)\Microsoft SQL Server\
*.txt
, more again

So my question is, where I can add the exclusion folder/files, Malware Profile or Exception Profile?

Hello Muhammad-Rusli,

It would be a best practice to first check the details of the incident and alarms within it to understand why the application was prevented, alert sources and the need for the exception. You can add more granular detail to your baseline policies configuring an exceptions profile. (f.e Process Exceptions, Support Exceptions, Behavioral Threat Protection Rule Exceptions, Local Analysis Rules Exceptions

Advanced Analysis Exception or Digital Signer Exceptions). With a Malware profile you can add files and folders to an allow list to exclude them from examination.

Endpoint Security Profiles:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-profiles.html

Exceptions security profiles:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/exceptions-security-profiles.html

Re: Different process exception on Exception Profile and Folder Allow List on Malware profile

magarcias — Tue, 08 Feb 2022 15:13:03 GMT

I'm also having a difficult time looking for file extensions exclusions if that is even possible?