topic How to whitelist folder in Cortex XDR Discussions

How to whitelist folder

JoaoMachado — Wed, 25 Oct 2023 08:46:19 GMT

Hello,

There is a user who is learning C/C++ and for the course, he has to do several small scripts.

is blocking all created scripts, marking them as malicious.

These are written in VSCode, but because they are compiled and run as .exe, I can't just whitelist VSCode.

So I wanted to whitelist a folder or workspace, but I'm not finding how. I thought it would be under "EXCEPTIONS CONFIGURATION > Disable Prevention Rules" but my test didn't work.

Thank you for all the help.

Re: How to whitelist folder

dbahuguna — Thu, 26 Oct 2023 09:36:08 GMT

Hi @JoaoMachado ,

Thank you for reaching out to Palo Alto Live Community.

You can try to define specific files and folders to exclude from examination and allow for execution. In the Policy you want this to apply to, it's under 'Malware Security Profile' > 'Files/Folders in Allow List'.

Here is the link to the documentation that explains the process:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-Malware-Security-Profile

You may have to do this for each component - portable executables, office docs, scans. I've included a few screenshots where you would do this. The screenshots also have examples of the formatting.

PE's and DLL

Scans

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: How to whitelist folder

eumbach — Fri, 27 Oct 2023 15:38:29 GMT

I would not whitelist a folder. This allows any application to be run from that directory. Instead, I would look into Code Signing.