Windows Defender Firewall blocking applications

AndrewBowden04 — Fri, 22 Jan 2021 19:32:31 GMT

Hello all,

We are moving from Symantec Endpoint Protection (SEP) to Cortex XDR. If you are not familiar with SEP, it has its own firewall built in. When active, Windows Defender only manages a few aspects of the firewall. Since moving to having Cortex manage the firewall, we keep getting pop ups that Windows Defender is blocking some applications. After some discussion with Tech Support, we find out that Cortex XDR uses and API to manage the Windows Firewall.

I have been looking for some documentation on either what I might be missing or some sort of best practice.

Any insight to what I may be missing or misunderstanding?

Re: Windows Defender Firewall blocking applications

JohnSmith7732 — Fri, 22 Jan 2021 21:51:55 GMT

thats interesting. I wish i could see it but we havent engaged it yet unfortunately so i will learn from you. I think SEP like many other vendors actually completely disables the windows firewall? You may have in fact been vulnerable. I think the cortex only engages the rules you choose. Can you put some context on things it might block? This one would seem to explain a little possibly?

By default, host firewall profile rules are based on the current location of your device. Configure two sets of rules: a set of
External Rules that apply when the device is located outside the internal organization network, and a set of
Internal Rules that apply when the device is located within the internal organization network. If you disable the
Location Based option, your policy will apply the internal set of rules only, and that will be applied to the device regardless of its location

topic Re: Windows Defender Firewall blocking applications in Cortex XDR Discussions

Windows Defender Firewall blocking applications

Re: Windows Defender Firewall blocking applications