topic System Lockdown with XDR in Cortex XDR Discussions

System Lockdown with XDR

Jaitapkar — Mon, 18 Jul 2022 08:56:01 GMT

Hi Folks,

With Cortex XDR can we use feature like System lockdown, more likely say that execute only allowed application and rest all blocked.

It is possible?

Regards,

Mansoor

Re: System Lockdown with XDR

bbarmanroy — Mon, 18 Jul 2022 10:17:26 GMT

Hi @Jaitapkar while this might not meet your needs, you can isolate an endpoint and prevent lateral movement and restrict all network activity.

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/response-actions/isolate-an-endpoint

Re: System Lockdown with XDR

MarvinC — Mon, 25 Jul 2022 01:42:52 GMT

Hi Jaitapkar,

Are you referring to certain feature like Sophos Server Lockdown where you cannot run/install any unauthorized or unrecognized application unless the lockdown was removed from the server and have the list updated.

As of now, there is no similar feature here in Cortex XDR. There is a restriction policy but it does similarly fit to the server lockdown function.

I highly suggest to contact the SE for a feature request regarding this and I'd also be happy seeing this feature in Cortex XDR.