topic Re: Scan endpoint error in Cortex XDR Discussions

Scan endpoint error

tlmarques — Fri, 02 Feb 2024 15:30:03 GMT

Hi, I need help, I have policy to allow scans on the endpoint, however users are unable to start the scans, the option does not appear

I can only scan, with cmd as administrator (cytool scan start) , in the GUI I can't even do it as administrator:

my configuration:

Re: Scan endpoint error

abdrahman — Sat, 03 Feb 2024 16:09:20 GMT

Dear @tlmarques ,

Hope you are doing well, and thank you for reaching out to our Live Community. From the above query I believe that you are trying to see how to configure the end users to initiate a full scan from the Cortex XDR interface locally on endpoint.

Please note that a full scan can only be initiated from Cortex XDR portal by navigating to Incident Response → Response → Action Center

Please find the document provided below for further details, thank you:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Scan-an-Endpoint-for-Malware

And for the configuration you have provided in the second screenshot, this configuration is used to allow the end user to initiate a right click scan on a file or folder as seen in the screenshot provided below, thank you:

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: Scan endpoint error

tlmarques — Mon, 12 Feb 2024 19:58:09 GMT

we've that configuration enabled....the problem is the agent...i open a case with support and we found the problem.

For future, if someone have the same problem, check that:

OS version:
In the case of Windows 11, it will show clicking the “Show More Options” in the context menu.

Registry:
This is a registry key related to “Show More Options” in the context menu.
Please check if they are in the registry key.
- HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Cortex.XDR.Scan
- HKEY_CLASSES_ROOT\CLSID\{44303AF8-6F09-4803-8639-9247339BE42D}
- HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\Cortex.XDR.Scan
- HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\Cortex.XDR.Scan

If registry keys are missing, please re-install the agent.