topic Re: Endpoint scans in endpoints with network shared folders in Cortex XDR Discussions

Endpoint scans in endpoints with network shared folders

fmohedano — Mon, 10 Apr 2023 08:31:55 GMT

By compliance, we need to set periodic endpoint scans. We have several endpoints which have network shared folders in common, and we wouldn't like to scan the same network shared folder several times at the same time. We would like to know how to solve that issue.
The ideal solution would be to have an option to scan the same network share folder just one time per scan in endpoints with the same profile.
We have thought to set the periodic scans in different hours (in endpoints with the same profile), but it wasn't possible either because we do not contemplate the option of creating a profile per endpoint.

Re: Endpoint scans in endpoints with network shared folders

anlynch — Tue, 11 Apr 2023 21:33:11 GMT

Hi!

Thanks for reaching out to LIVEcommunity!

I'm looking into this and I'll get back with you shortly.

Have a great day!

Re: Endpoint scans in endpoints with network shared folders

bbarmanroy — Wed, 12 Apr 2023 01:27:48 GMT

Hi @fmohedano , to meet compliance requirements, you can create a separate profile for one endpoint only, with network scan enabled. It is recommended to use a server as the endpoint to ensure that it is always on and runs the scan at the scheduled time. Workstations (laptops, desktops) might not be ideal as they're dependent on factors like the user being out of office for extended periods, unmounting the shared drive, network connectivity issues and other potential causes that might cause the scan to be skipped.

Re: Endpoint scans in endpoints with network shared folders

MarvinC — Wed, 12 Apr 2023 01:34:40 GMT

Hello @fmohedano ,

This could be a problem on how policy inheritance works.

The inheritance works from top to bottom.

We can resolve your issue by doing different profiles based on their common identified and create exclusion on the Endpoint Scanning if they have a common network share folder.

Unfortunately, due to your requirement for them to be scanned on different hours and different situation -- only 1 malware profile can be inherited at once.

I hope you can open up a ticket or try to reach out to your SE for further assistance.