topic Re: XDR allwoing blocked files to run in Cortex XDR Discussions

XDR allwoing blocked files to run

Aiman_Fathima — Wed, 13 Jul 2022 08:47:48 GMT

Hello,

Even though we have added the file hash to the BLOCK LIST, XDR still alllows the process to run. Does someone know the reason for why this is occuring.

Re: XDR allwoing blocked files to run

jtalton — Wed, 13 Jul 2022 20:06:25 GMT

Hello Aiman_Fathima,

Blocking files on endpoints is also enforced by the endpoint malware profile. Please ensure that your Malware Security Profile is set to block mode.

In Action Center, on the Block list page, you may select Override Report mode to allow the agent to block hashes even if the Malware Profile is set to Report.

Please check Action Center to confirm the file hash is in the Block List: Incident Response >Response> Action Center > Block List
Select Override Report mode to allow the agent to block hashes even if the Malware Profile is set to Report.

If all is configured, please open a support case for troubleshooting.

Reference

Endpoint Security Profiles (paloaltonetworks.com)

Add a New Malware Security Profile (paloaltonetworks.com)

Thanks

Re: XDR allwoing blocked files to run

Aiman_Fathima — Fri, 15 Jul 2022 08:35:11 GMT

Thank you

Re: XDR allwoing blocked files to run

Cyber1985 — Wed, 20 Jul 2022 15:35:13 GMT

Was this your solution? From our expierience you should watch out if this hash/File is not in the Quarantäne. In some of our cases the computer needs a restart to work.

It would be nice to know, how we can check, if this blocked hash is updaten to the Client.

Rob