topic Re: Need Clear idea on XDR action on file in Cortex XDR Discussions

Need Clear idea on XDR action on file

Venkatesh_Konar — Fri, 28 Jul 2023 13:38:04 GMT

Dear All ,

Once XDR taken action on a set of files which seems to be suspicious . Apart from Wildfire verdict , its also shows XDR action like Detected , Prevented (blocked ) .

How can I confirm Actual Action by XDR is Quarantine / Cleaned / Deleted ?

Re: Need Clear idea on XDR action on file

abdrahman — Mon, 31 Jul 2023 10:39:41 GMT

Dear @Venkatesh_Konar

Hope you are doing well. From your query I understand you would like to know what happens to a file once it is detected by Cortex XDR to be malicious. Please note that the action taken on the files depends on the Malware security profile configurations.

Please check the malware profile which is configured for the device in question and see if it is set to Block, Report or Disabled. If it is set to Block then please check what action is to be taken on the file such as Quarantine the file or delete it. Please find the Knowledge base articles provided below on Malware security profile:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-Malware-Security-Profile

Also please find the documentation on how to manage Quarantine files below, thank you:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-Quarantined-Files

Hope this answers your query, please reply back to this thread if there is anything else I can assist you with on this query. If you find this answer to be useful, please mark it as a solution, thank you.

Re: Need Clear idea on XDR action on file

afurze — Tue, 01 Aug 2023 13:55:02 GMT

Hi Venkatesh_Konar,

Just to add on to what @abdrahman already said, if the file was also quarantined in addition to being blocked, the action will be reported as Prevented (quarantined), but whether this is done is based on your Malware Profile configuration. Note, XDR does not automatically delete files, only optionally quarantine them.

Correction, this is not shown as a part of the alert action information. You can confirm this by going to the Action Center and clicking on File Quarantine to see the list of currently quarantined files on all endpoints.