Agent Blocking files/processes dynamically based on conditions

michaelsysec242 — Sun, 19 Mar 2023 08:17:41 GMT

Hello XDR Enthusiasts,

I am working with multiple XDR Tenants and would like to block a file/process based on conditions. I understand that you can use the Prevention features to block files based on a block/black list. This can also be configured on the Malware Profile settings where specific severity incidents can induce the agent to block the file automatically. My question is; Is it possible to configure conditions for the Agent to stop a file? For example only when a filename does not equal X then block it?

I thought of two solutions, yet I am not sure that they will be suitable;

To create a BIOC rule with a critical severity or similar in order that the block rule can be determined on policy based on its severity. I am not sure that the XDR has this capability.
I am working with a Production Level Cortex XSOAR, is there a playbook or automation that can be implemented to block the file during it's runtime? Due to the time delta between the agent identifying and the XSOAR running a playbook there will be a delay.

I would be interested to know whether the XDR Agent blocking abilities can be set to default based on rules.

Many thanks,

Re: Agent Blocking files/processes dynamically based on conditions

bbarmanroy — Mon, 20 Mar 2023 02:18:33 GMT

Hi @michaelsysec242 the ability to create custom BIOC to terminate an execution should do the trick. Please look into this LiveCommunity post where the solution has been explained.

topic Agent Blocking files/processes dynamically based on conditions in Cortex XDR Discussions

Agent Blocking files/processes dynamically based on conditions

Re: Agent Blocking files/processes dynamically based on conditions