topic Re: Folder and File exclusions wildcard question in Cortex XDR Discussions

Folder and File exclusions wildcard question

MatteoNatalicchio — Tue, 23 May 2023 12:30:31 GMT

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-Malware-Security-Profile

The docs says:

(Optional) Add files and folders to your allow list to exclude them from the examination.

+Add a file or folder.
Specify the path and press Enter or click the check mark when done. You can also use a wildcard to match files and folders containing a partial name. Use ? to match a single character or * to match any string of characters. To match a folder, you must terminate the path with * to match all files in the folder (for example, c:\temp\*).

A ) What if i want to match all folders under a certain path?

Does (c:\temp\*) match c:\temp\folder1\file.xml ? (i don't think so)

I don't necessarily know how many folders there are, I need to be able to match any number of subfolders

B ) Or what if I want to match any file having a certain extension anywhere in the file system?

(all file ending with .xml as an example)

Re: Folder and File exclusions wildcard question

anlynch — Wed, 24 May 2023 01:26:59 GMT

Hi @MatteoNatalicchio,

Thanks for reaching out through LIVEcommunity!

I'm going to break your questions apart and answer them for clarity.

A ) What if i want to match all folders under a certain path?

Does (c:\temp\*) match c:\temp\folder1\file.xml ? (i don't think so)

I don't necessarily know how many folders there are, I need to be able to match any number of subfolders

Simply put, yes. C:\temp\* covers all files and folder in the directory. Doesn't matter how many other folders are contained within, this encompasses them all.

B ) Or what if I want to match any file having a certain extension anywhere in the file system?

(all file ending with .xml as an example)

In this example you could do something like C:\Temp\*.xml. The addition of the '.xml' means it will only search for .xml files in the Temp directory. You could something like C:\*\*.xml. Where the first '*' could represent any number of nested folders and target files in those folders ending with the ".xml" extension. I strongly recommended testing in your own environment to confirm this works for your usecase.

I hope you find this information helpful.

Re: Folder and File exclusions wildcard question

MatteoNatalicchio — Wed, 24 May 2023 13:22:24 GMT

Hi Anlynch,

With question A, i mean that i need to exclude all the possibly existing level of nested subfolders, without having to indicate them explicitly

C:\temp\file.pdf

C:\temp\folder1\folder1a\file.xml

C:\temp\folder2\folder2a\folder2a1\file.txt

Are you sure that C:\temp\* will works even for the files on the nested folders ?

For question B: if i need to exclude all XML on any existing file systems, could i write: *\*.xml ?

Cheers

Re: Folder and File exclusions wildcard question

anlynch — Wed, 24 May 2023 14:39:39 GMT

Hi, @MatteoNatalicchio,

For question A:

Yes, what I provided earlier will work for any file or folder nested in the C:\Temp\ Directory.

For questions B)

I think that would work. To be sure though, it's best to test it in your own environment and observer for any potentially unwanted behaviors. Wildcards are powerful tools.