topic Re: Pause Endpoint protection in Cortex XDR Discussions

Pause Endpoint protection

Shahwaz_Md — Wed, 31 May 2023 12:29:41 GMT

Will XDR services be stopped when we pause endpoint protection?

Re: Pause Endpoint protection

PiyushKohli — Thu, 01 Jun 2023 03:14:11 GMT

Thank you for writing to live community!

No, XDR services won't be stopped when we pause endpoint protection. Because with pause protection agent will still retain connectivity with the server to take any actions from the server, its just pausing the protection which means agent will run with all the profiles disabled.

You may refer in the documentation here for the same.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: Pause Endpoint protection

Shahwaz_Md — Thu, 01 Jun 2023 11:02:12 GMT

Thanks for the response Piyush.

Actually, the client asks us to disable xdr on an endpoint coz they might be doing some activity or some installations for ex and do not want XDR to block it. So what we do is , we tell them to stop the services and start post completion of the activity.(runtime stop/start)

Can we pause protection instead of that?

Thanks

Shahwaz

Re: Pause Endpoint protection

afurze — Thu, 01 Jun 2023 14:50:17 GMT

Shahwaz_Md,

It is usually not a good idea to be pausing or disabling protection services unless it is to troubleshoot the agent itself. XDR should not be interfering with normal user or administrator activity and, if it is, appropriate alert tuning actions should be taken to address this. If users or administrators have the capability to disable the agent, it becomes much less likely that you will be able to identify and protect against insider threats.