Active Scanning on Endpoints

Shashanksinha — Mon, 21 Nov 2022 14:30:38 GMT

We intend to perform scheduled scanning on all endpoints. So we wondered if active scanning was required on all endpoints repeatedly, or if cortex developed its own scan whenever a new file was created or added to the system.

Re: Active Scanning on Endpoints

eluis — Mon, 21 Nov 2022 15:38:10 GMT

Hi @Shashanksinha

CXDR doesnt work as a traditional AV. We are not the same. We do not scan files continously since this is time consuming and even worst high consumption of resources for very little value. Scanning AVs are based on old signatures that advance attackers never use, which leave you unprotected against real threats.

We are based on behavior. Even though you can still perform scheduled scans, we do not recommend to do it too often to not to waste your assets resources also as mentioned before you wont detect may threats that are not on AV signatures.

Scans in CXDR are performed just if you configure them, so not by default

Hope this helps,

Luis

topic Active Scanning on Endpoints in Cortex XDR Discussions

Active Scanning on Endpoints

Re: Active Scanning on Endpoints