topic Re: XDR command line scan in Cortex XDR Discussions

XDR command line scan

PaulDownes — Thu, 04 Nov 2021 15:09:37 GMT

Hi All, I've been looking at the functionality of the cytool command line and cannot find a way to scan a particular file, which is available if you right click the file in Windows. Can anyone tell me if the ability to scan an individual file, or folder available from command line in XDR client?

Thanks, Paul

Re: XDR command line scan

kiwi — Tue, 09 Nov 2021 13:02:48 GMT

Hi @PaulDownes ,

In order to get better traction for this, I have moved your query to the Cortex area.
I would recommend that you visit this area to see your discussion and others on Cortex.

Cheers,

-Kiwi.

Re: XDR command line scan

fmoixsante — Tue, 09 Nov 2021 13:19:02 GMT

Hi @PaulDownes

The scan malware option is not part of the cytool commands.

There are some alternatives

cytool fileinfo c:\path\to\app1.exe - process needs to be known to WF/LA
1. this will give you information about app1.exe. you want to look for the File SHA256 value
cytool wf query app1_sha256_value
1. If you do not get a result, it means that WF/LA do not know it. At this point, you first need to upload the file to WF. You can do that by scanning the file using the mouse
2. you could use cytool imageprep. this will look at all the volumes are upload to WF those that are unknown. This operation could take quite some time, at least the first time executed. Later imageprep scans, would take less time as only those new unknown executables will be uploaded to WF.

Re: XDR command line scan

P.Jacob — Tue, 09 Nov 2021 15:00:55 GMT

looks like looking at the official docs you can just start a scan:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/5-0/cortex-xdr-agent-admin/traps-agent-for-windows/troubleshoot-traps-for-windows/cytool.html

I would however confirm with the tac

Re: XDR command line scan

PaulDownes — Thu, 11 Nov 2021 14:22:53 GMT

Thanks folks, all very helpful. I'm going to accept Fmoixsante's suggestion about the imageprep scan as the accepted solution, might be able to run with that. If there was something flagged on the client machine to say the scan marked the file safe / unsafe, I could possibly use that to trigger a subsequent action to admins also. I appreciate the insights from you all, thanks again.