Cortex XDR 3.5 - Whitelist UI

RamyashreeMada — Thu, 05 Jan 2023 07:43:06 GMT

Hello,

How Legacy Exceptions are different from Policy/profiles in Policy management.

Re: Cortex XDR 3.5 - Whitelist UI

nikoolayy1 — Sun, 08 Jan 2023 08:32:45 GMT

Do you mean exclusions as if so there is a discussion about this as one supresses the alarms and the other is a real whitelist https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-exclusions-vs-exceptions/td-p/345719 .

Or you mean the real old XDR 3.5 and below legacy exceptions as then just see https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Exception-Configuration

---------

Prior to Cortex XDR version 3.5, Legacy Agent Exceptions and Support Exceptions were configured through their relevant profiles.

Starting with version 3.5, Cortex XDR enables you to manage the Legacy Agent Exceptions and Support Exception configurations from a central location and easily apply them across multiple profiles in the Agent Exceptions Management page.

To manage the Prevention profile exceptions from Exception Configuration, you must first migrate your existing exceptions configured via profiles. Your existing exception profiles are migrated per module.

Cortex XDR simulates the migration to enable you to review the results before activating the migration.

---------------

Also this are usefull info as some file and folder whitelists are not in the Exceptions profile:

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/different-process-exception-on-exception-profile-and-folder/td-p/428786

https://www.youtube.com/watch?v=-Bzed6rRoSs

topic Cortex XDR 3.5 - Whitelist UI in Cortex XDR Discussions

Cortex XDR 3.5 - Whitelist UI

Re: Cortex XDR 3.5 - Whitelist UI