topic Re: Cortex XDR to take the cleanest snapshot of windows for rollback. in Cortex XDR Discussions

Cortex XDR to take the cleanest snapshot of windows for rollback.

Jim_Gabales — Sun, 05 Nov 2023 05:40:23 GMT

Hi LIVEcommunity,

Is there a way for Cortex XDR to take the cleanest snapshot of windows so there is a point where we can rollback the endpoint after an attack?

Windows has a feature called Volume Shadow Copy Service (VSS) but can Cortex XDR use this after a ransomware attack? What if the VSS is corrupted, how can Cortex XDR protect the VSS and rollback to the cleanest state of the endpoint?

We are trying to compete with other product that has a feature like this, but I cannot find documentation stating how can Cortex XDR accomplish this task.

I hope experts in this community can guide us. Thank you.

- Jim

Re: Cortex XDR to take the cleanest snapshot of windows for rollback.

abdrahman — Mon, 06 Nov 2023 10:34:30 GMT

Dear @Jim_Gabales ,

Thank you for reaching out to the Live Community. We do have a feature in Cortex XDR which assist in backup management where we can enable or disable the automatic backup on Windows using VSS.

You can find these settings in policy management> Agent settings> backup management. However, as far as I know we cannot take a backup of the endpoints on the Cortex XDR so that we can restore using it. We can only manage the enabling or disabling of the backup from the Cortex XDR. Thank you.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: Cortex XDR to take the cleanest snapshot of windows for rollback.

benjamin_nogue — Wed, 15 Nov 2023 15:08:22 GMT

Hello @abdrahman , I was looking at this new feature "Backup Management" and you explained that it works with the VSS.
However, I listed the VSS writers and I do not see a Writer "Cortex XDR".

Does it mean that the shadow copy driven by the agent has not been write ?

I checked the Agent Settings profile and I can see that the option is Enabled.

How can I check on the endpoint that the backup has been made by the agent ?

Regards,

Benjamin

Re: Cortex XDR to take the cleanest snapshot of windows for rollback.

Jim_Gabales — Wed, 15 Nov 2023 15:48:26 GMT

I see, but can we automate the part of restoring it using the enabled shadowcopy? we have a remediation suggestion feature "restoring files", right? Will it trigger the shadow copy to be restored?

Re: Cortex XDR to take the cleanest snapshot of windows for rollback.

SeanDeHarris — Wed, 24 Sep 2025 12:17:18 GMT

@benjamin_nogue @Jim_Gabales
Hello experts,
Sorry for bothering you, this is an old thread, just came accros the same queries as you.

Did you find out the answer ?

it seems XDR will just "enabled" the VSS on the endpoints which relies on the default Schedule of the VSS volumn, XDR (is not a backup software) will not fire an VSS snapshot backup, i guess. please correct me if i'm wrong.

Thanks