topic Re: Cortex XDR folder exclusion in Cortex XDR Discussions

Cortex XDR folder exclusion

DanieleGerola — Mon, 24 Aug 2020 13:41:43 GMT

Hello,

does anyone know if it is possible to exclude an entire folder on a Windows machine from Cortex XDR scan in order to launch executable files without being blocked and having to add the file hash to the whitelist ?

Re: Cortex XDR folder exclusion

Ryan_Saulsbury — Tue, 08 Sep 2020 15:26:27 GMT

You are able to define specific files and folders to exclude from examination and allow for execution. In the Policy you want this to apply to, it's under 'Malware Security Profile' > 'Files/Folders in Allow List'.

Here is the link to the documentation that explains the process:
https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-pro-admin.pdf#page=103&zoom=100,76,70

Re: Cortex XDR folder exclusion

dfalcon — Mon, 14 Sep 2020 13:30:09 GMT

Hi @DanieleGerola-

@Ryan_Saulsbury is correct. You can allow exclusions in the malware profile. You may have to do this for each component -- portable executables, office docs, scans. I've included a few screenshots where you would do this. The screenshots also have examples of the formatting.

PE's and DLL

Scans

Re: Cortex XDR folder exclusion

Retired Member — Fri, 25 Sep 2020 22:15:25 GMT

My interpretation of the setting for exclusion for files in the Malware profile is only for dormant files when you use the weekly/monthly scan. How do you exclude an entire folder completely?

Re: Cortex XDR folder exclusion

Retired Member — Fri, 25 Sep 2020 22:17:00 GMT

Ah, I see now... I overlooked the first picture! Thanks! I was not the original poster, but we appear to have a conflict with an encryption product.