topic Adding Process\file global exceptions in XDR in Cortex XDR Discussions

Adding Process\file global exceptions in XDR

Daniel_Itenberg — Tue, 12 Jul 2022 07:55:06 GMT

Hi,

I want to add an exception for an in house app that the xdr keeps blocking. I tried adding a global exception as outlined here - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/exceptions-security-profiles/add-a-global-endpoint-policy-exception#add-a-global-endpoint-policy-exception

However I dont have the option to create an alert exception in the right click menu. I am an admin in our xdr.

How can i create an exception?

Re: Adding Process\file global exceptions in XDR

afurze — Tue, 12 Jul 2022 19:55:44 GMT

Hi Daniel_Itenberg,

The context menu changes depending on the alert you select. If the alert is a Behavioral Threat Protection (BTP) alert, you will have the "Create Alert Exception" option under Manage Alert. If the alert is a Local Malware Analysis alert, you will have the "Add initiator SHA256 to Allow list" option under Manage Alert. Can you please confirm the source of the alert and the alert name? This will tell us what kind of alert you are trying to create an exception for.

Re: Adding Process\file global exceptions in XDR

bbarmanroy — Wed, 13 Jul 2022 02:03:22 GMT

The broadsword approach to the solution is to add it to the Global Allow List : https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-response/investigate-files/manage-file-execution

Re: Adding Process\file global exceptions in XDR

Daniel_Itenberg — Wed, 10 Aug 2022 09:55:27 GMT

I want to completely exclude examination of said process from all endpoints in my organisation. adding to the allow list dosent help because the sha256 is different everytime the program is run. I know there is a way to add global exceptions to the local malware analysis module, however there is no such option available to me, and that's what i need

Re: Adding Process\file global exceptions in XDR

jcandelaria — Wed, 10 Aug 2022 16:08:26 GMT

@Daniel_Itenberg

Kindly refer to our webinar --> around 12:15 timeframe https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-alert-tuning-operations/ta-p/505838

Re: Adding Process\file global exceptions in XDR

tech_noob — Wed, 10 Apr 2024 00:58:28 GMT

After your Add initiator SHA256 to Allow list, can you still revert back if needed? Remove the SHA256 from the allow list?