topic Periodic Endpoint scanning on users directory in Cortex XDR Discussions

Periodic Endpoint scanning on users directory

Joel777 — Mon, 30 Oct 2023 17:30:23 GMT

Is there a way to only scan the users directory? Adding folders in allow list c:\Users\* does not work and scans everything on the device. How can I accomplish this task by only scan the users directory and not scan the entire system?

Re: Periodic Endpoint scanning on users directory

aspatil — Tue, 31 Oct 2023 11:01:21 GMT

Hello Joel,

Thank you for writing to Live Community.

At this point in time, there is no way to run a periodic scan of only one location. Periodic scans can be configured via the Agent Settings Profile, or you can initiate manual malware scans of an entire filesystem via the Action Center or API.

That Allow List is to define the exclusion, not for scanning the particular folder.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: Periodic Endpoint scanning on users directory

MosR — Tue, 31 Oct 2023 17:14:57 GMT

Unfortunately, Cortex scans always start from the C drive. Not sure PA is missing a feature that's been around in other products for a very, very long time. Yes, the claim is that Cortex is an event and behavioral based solution, it would detect the malware on action. But, what about external drive with terabytes in size and has dormant malware. Unless PA adds this feature, you have to go through C drive before you get to D,E or maybe F drive.