topic Re: exclusions vdi non-persistent in Cortex XDR Discussions

exclusions vdi non-persistent

tlmarques — Tue, 31 Oct 2023 16:08:26 GMT

Hello, does anyone know if there is any document that tells us which folders and subfolders we should exclude from XDR when using Citrix and VMware Horizon with non-persistent VDI?

In Palo Alto's documentation, I don't see anything specific except for the app layers. However, both Citrix and VMware request the exclusion of many folders from the AV system. Can someone help?

Re: exclusions vdi non-persistent

aspatil — Wed, 01 Nov 2023 08:13:08 GMT

Hello Tiago,

Thank you for writing to Live community.

Could you please refer below article and discussion and let me know if that helps.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Cortex-XDR-Agent-for-Virtual-Environments-and-Desktops

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/non-persistent-vdi-shows-up-as-golden-image-instead-of-vdi/td-p/436166

Please mark the response as "Accept as Solution" if it answers your query.

Regards.

Re: exclusions vdi non-persistent

neelrohit — Wed, 01 Nov 2023 12:08:03 GMT

Hi @tlmarques ,

Thank you for writing to live community!

Besides what @aspatil mentioned, it really depends on Citrix variants that are available in your infrastructure. For example, there are some types of Citrix devices as below:

Storefront
Cloud Connector
Receiver for Windows
HVD Servers etc.

Based on the above and there could be many more, some whitelists that are generally made in Pre-execution modules of Cortex XDR Malware Profiles could be under the Citrix folders(eg. C:\ProgramData\Citrix\*,C:\Program Files (x86)\Citrix\*,C:\Program Files\Citrix\*)

However, we know that these are very broad whitelists and hence, you can ask your vendor to provide you with more granular whitelists which would definitely be a good use case to make under scanning and pre-execution allowlists.

Hope this helps. Please mark the response as "Accept as Solution" if it answers your query.

Regards

Re: exclusions vdi non-persistent

tlmarques — Fri, 17 Nov 2023 14:51:31 GMT

I've put the whitelist you share (eg. C:\ProgramData\Citrix\*,C:\Program Files (x86)\Citrix\*,C:\Program Files\Citrix\*) on "Portable Executable and DLL Examination"