Cortex XDR Block List Question

timleung — Fri, 03 Mar 2023 06:58:12 GMT

I want to know the maximum number of IOC hash that can be stored in the blocklist of the Cortex XDR Platform.

I want a reply from the Paloalto official. Thanks.

Re: Cortex XDR Block List Question

neelrohit — Sun, 05 Mar 2023 09:05:24 GMT

thank you for writing to live community!

IOC itself has a limit of 4M IOC in cortex xdr. However, for hashes blocklist or allowlist, we do not have any specific limits set. The hash exception is part of a database in the xdr agent and hence more number of hashes means more data written to the db file on the local system. The agent quota is by default set to 5000Mb and hence(which can be upscaled to 10Gb) as long as the db file size stays within the quota limits, there can be hashes that can be added accordingly.

hope this helps!

topic Cortex XDR Block List Question in Cortex XDR Discussions

Cortex XDR Block List Question

Re: Cortex XDR Block List Question