Testing malware blocking and alerting in the xdr

Daniel_Itenberg — Sun, 17 Oct 2021 13:09:06 GMT

Hi all,

I'm trying to run checks on my mac, that has a cortex xdr agent, trying to see how the blocking & quarantine functions before setting the policy to all endpoint in my organization.

However, EICAR files, and the test file that palo alto provides here - https://docs.paloaltonetworks.com/wildfire/10-1/wildfire-admin/submit-files-for-wildfire-analysis/verify-wildfire-submissions/test-a-sample-malware-file - Don't generate any alerts nor any incidents.

I'd appreciate help in the matter

Re: Testing malware blocking and alerting in the xdr

P.Jacob — Mon, 18 Oct 2021 13:34:39 GMT

hello, I have always used those and have not had an issue. I was using them to get all my alerting setup to ingest into my siem.

have tried to execute them? simply downloading them won't get caught unless you have the file scanning set up.

topic Re: Testing malware blocking and alerting in the xdr in Cortex XDR Discussions

Testing malware blocking and alerting in the xdr

Re: Testing malware blocking and alerting in the xdr