topic File scanning. in Cortex XDR Discussions

File scanning.

Joe_Carissimo — Thu, 14 Sep 2023 20:19:54 GMT

Hey All, question for you.

What process does an XDR agent follow when a user opens a simple .pdf or .docx file? I am trying to find something basic to explain this to one of our Executive Managers who is concerned that the agent is causing common apps like Adobe Reader and Word to open slowly.

Appreciate any info you can offer.

Thank you,

Joe

Re: File scanning.

aspatil — Fri, 15 Sep 2023 08:24:31 GMT

Hello Joe,

Good Day!

Kindly confirm, if you are looking for the information provided in the below article?

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/File-Analysis-and-Protection-Flow

Re: File scanning.

SeanDeHarris — Mon, 18 Sep 2023 07:22:02 GMT

XDR will inject DLL to monitor for exploitations on the files being opened. It does not posing any significant impact to the process performance.

Re: File scanning.

Joe_Carissimo — Mon, 18 Sep 2023 20:19:10 GMT

Thank you, @aspatil . I appreciate your reply. I had already read through that but was looking for something more simple. That information does not say either way if there is a scan each time a file is opened. Like they are avoiding using that word. "the Cortex XDR agent seamlessly injects code"...

I would hate to copy/paste that and give it to some of our Executive Management as an explanation.

Thank you,

Joe

Re: File scanning.

Joe_Carissimo — Mon, 18 Sep 2023 20:20:46 GMT

Hi @SeanDeHarris, thank you. Yes, I read that already.

Regards,

Joe