Allow based on certifcate issuer?

mssp_ctunks — Tue, 27 Jun 2023 15:24:23 GMT

We are currently having an issue with our database disk images being blocked that are set on rotation cycles. The file name and the hash changes incrementally. All our disk images are signed, using a certificate by the issuer; this was used previously to stop these executables from being blocked.

Is there a way to exclude or allow based on the certificate issuer?

Re: Allow based on certifcate issuer?

anlynch — Tue, 27 Jun 2023 16:27:11 GMT

Hi @mssp_ctunks,

Thanks for reaching out on LIVEcommunity.

I can definitely see how this issue would cause some headaches. I would recommend adding the exception as a folder instead of a file since the names and hashes change. If you can exclude the folder it should exclude any processes running within that folder. I'd like to caution you to be mindful that anything nested in the folder will be excluded as well. I'll leave some information about this right here.

With the introduction of Cortex XDR 3.5 all of the exception have now been moved to the Global Exceptions Configuraiton which is accessible as seen below.

I would just caution that you test this method to verify it's validity before deploying to a production environment.

Lastly, If that doesn't work out properly. I highly suggest reaching out to support as they should be able to provide you with support exception to deal with your issue specifically.

I hope you find this information helpful.

Have a great day!

topic Allow based on certifcate issuer? in Cortex XDR Discussions

Allow based on certifcate issuer?

Re: Allow based on certifcate issuer?