topic Re: News about CPATR-10685? This bug is disrupting production in Cortex XDR Discussions

News about CPATR-10685? This bug is disrupting production

YAlhazmi — Wed, 17 Mar 2021 09:55:09 GMT

Hello Everyone,

Does anyone know where I find more information about this bug: CPATR-10685? We reported an issue where if the malware scan is running a dll cannot be loaded twice because Cortex XDR will block it and were given this bug number, but I cannot find it anywhere in the known or addressed issues.

The fact that a dll is only allowed to be accessed ONCE during a malware scan means that if a developer or automated build process build an application twice while the malware scan is running, the builds will fail because Cortex is locking the files. This is really disrupting our production.

Kind regards,

Yasser

Re: News about CPATR-10685? This bug is disrupting production

gjenkins — Wed, 17 Mar 2021 16:09:06 GMT

Hi @YAlhazmi,

The referenced case, CPATR-10685, does not appear to be a known issue typically published here for the server and here for the agent. The lack of inclusion indicates that the issue you're encountering is likely particular to your environment. Additionally, it appears that you have a severe issue of which is impacting your production environment. As such, the recommendation here would be to open a case with Support to inquire about the case's progress and its resolution as soon as possible. In fact, I would highly recommend giving them a call to speak with an engineer as soon as possible at one of the following numbers to discuss:

Technical Support

US: (866) 898-9087
Int'l: +1 (408) 738-7799
EMEA Support: +31 20 808 4600 (Available from all countries)
APAC Support: +65 3158 5600 (Available from all countries)
Japan Support: 01 2018 4025 (Toll free from Japan only)
Australia Support: 1 800 002 378 (Toll free from Australia only)
China Support: +86 400 639 9205 (Toll free from China only)
France +33 186995753
Germany +49 69945189855
Hong Kong Support: +86 400 639 9205 (Toll free from Hong Kong only)
India Support: 000 800 442 0164 (Toll free from India only)
Saudi Arabia Support:
- 800844 0412 (Toll free for Saudi Telecom Company Customers Only)
- 800850 0011 (Toll free for Bharti Airtel Customers Only)
Switzerland +41 445299182
UK country +44 2039012097
United Arab Emirates Support: 8000 444 0585 (Toll free from UAE only)

Re: News about CPATR-10685? This bug is disrupting production

YAlhazmi — Wed, 17 Mar 2021 17:46:54 GMT

Hello @gjenkins and thank you for your response!

I don't think that the issue is particular to our environment. We have tried it in all sorts of machines including fresh OS installs and it can happen to anyone. The preconditions are

Malware scan is running
Dll or exe file is loaded twice during the scan (which is common in development)

So, it is not particular to our environment.

We communicated with support beginning February and their response was that this is a bug and they don't have a workaround for it and that there will be a fix in next release. Next release (7.3) came out and we didn't find anything regarding it. We contacted support again, and their response this time was "[fix] is planned to be released in version 7.4 ... [but] support team does not have knowledge regarding roadmap plans".

Re: News about CPATR-10685? This bug is disrupting production

gjenkins — Thu, 18 Mar 2021 21:23:40 GMT

Hi,

I'm glad to hear that you've opened up a communication line to get more information regarding CPATR-10685. Please be sure to request updates regarding your break/fix issue via Support cases which they will hopefully resolve soon. If you find that you need general product guidance, do reach out.