Mac offline scan

EricBjurstrom — Mon, 06 Nov 2023 18:11:17 GMT

We have a mac that we suspect may be compromised. We would like to run a scan with the device offline and not connected to our network.

How would we go about doing this?

Re: Mac offline scan

dbahuguna — Tue, 07 Nov 2023 06:43:15 GMT

Hi @EricBjurstrom ,

Thank you for reaching out to Palo Alto Live Community.

In case your endpoint is compromised then you can first isolate the compromise endpoint. When you isolate an endpoint, you halt all network access on the endpoint except for traffic to Cortex XDR. This can prevent a compromised endpoint from communicating with other endpoints thereby reducing an attacker’s mobility on your network. please refer the document below for more information:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Isolate-an-Endpoint

After isolating the endpoint you can run the malware scan on a compromised endpoint, please refer the document below for more information about malware scan:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Scan-an-Endpoint-for-Malware

Hope this helps!

Please mark the response as "Accept as Solution"

topic Re: Mac offline scan in Cortex XDR Discussions

Mac offline scan

Re: Mac offline scan