https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/enable-endpoint-file-scanning-documentation-clarification/m-p/534773#M3853 <P>Hello -</P> <P>&nbsp;</P> <P>On step 16 of <A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-a-New-Malware-Security-Profile" target="_self"><SPAN class="coverbar-title" title="Cortex XDR Prevent Administrator Guide"><SPAN class="breadcrumb-item">Add a New Malware Security Profile</SPAN></SPAN> (Prevent)</A>, there is a note:</P> <P><EM>We recommend that you disable scheduled scanning. VDI machine scans are based on the golden image and additional files will be examined upon execution.</EM></P> <P>&nbsp;</P> <P>I'm assuming based on the the second sentence that this only applies to VDI machines. It is throwing me off that the first sentence doesn't have a disclaimer.</P> <P>&nbsp;</P> <P>Does anyone have any additional guidance on this? In our case, we are only looking to enable on physical machines.</P> Thu, 16 Mar 2023 20:29:54 GMT Joseph_Hunter 2023-03-16T20:29:54Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/enable-endpoint-file-scanning-documentation-clarification/m-p/534773#M3853 <P>Hello -</P> <P>&nbsp;</P> <P>On step 16 of <A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-a-New-Malware-Security-Profile" target="_self"><SPAN class="coverbar-title" title="Cortex XDR Prevent Administrator Guide"><SPAN class="breadcrumb-item">Add a New Malware Security Profile</SPAN></SPAN> (Prevent)</A>, there is a note:</P> <P><EM>We recommend that you disable scheduled scanning. VDI machine scans are based on the golden image and additional files will be examined upon execution.</EM></P> <P>&nbsp;</P> <P>I'm assuming based on the the second sentence that this only applies to VDI machines. It is throwing me off that the first sentence doesn't have a disclaimer.</P> <P>&nbsp;</P> <P>Does anyone have any additional guidance on this? In our case, we are only looking to enable on physical machines.</P> Thu, 16 Mar 2023 20:29:54 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/enable-endpoint-file-scanning-documentation-clarification/m-p/534773#M3853 Joseph_Hunter 2023-03-16T20:29:54Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/enable-endpoint-file-scanning-documentation-clarification/m-p/534809#M3855 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/223197">@Joseph_Hunter</a>&nbsp;yes you can configure periodic scans on physical machines. Ultimately, this depends on the policy which the malware profile is assigned to. Ensure that the policy is configured to all devices where installation type is not 'VDI'.</P> Fri, 17 Mar 2023 06:23:16 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/enable-endpoint-file-scanning-documentation-clarification/m-p/534809#M3855 bbarmanroy 2023-03-17T06:23:16Z