topic Re: wf_vericts json file verdict values? in Cortex XDR Discussions

wf_vericts json file verdict values?

JoeDay — Wed, 17 Mar 2021 22:33:19 GMT

Exported wf_verdicts.db from an endpoint to validate local verdicts. Is there any reference for return codes and their meanings?

example:

"value": {
"verdict": 3,
"lruData": {
"lastUsed": "1613061210",
"index": "65945"

Re: wf_vericts json file verdict values?

gjenkins — Thu, 18 Mar 2021 21:12:38 GMT

Hi @JoeDay,

It appears that you are trying to collect the local verdict for a file on an endpoint by extracting the wf_verdicts.db file. Currently, there's no public documentation available to share regarding the file. Would you like to explain that goal that you have in mind that would potentially utilize this information?

Re: wf_vericts json file verdict values?

gjenkins — Thu, 25 Mar 2021 16:06:14 GMT

Hi,

I'd also like to point out that the local hash cache can be queried on Windows Endpoints using the following command which is more user-friendly than viewing the db file.

cytool wf query [<hash>]

Note: The supervisor password is required to issue this command.

Source: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-0/cortex-xdr-agent-admin/cortex-xdr-agent-for-windows/troubleshoot-cortex-xdr-for-windows/cytool.html

Re: wf_verdicts json file verdict values?

JoeDay — Mon, 12 Apr 2021 21:01:48 GMT

The verdicts handling was changed in version 7.2.

To check (verify) the verdict on the agent.

Export the entire wf_verdicts.db using cytool command: cytool persist export wf_verdicts.
Open the resulted JSON file using Text editor and search on the hash

Verdicts:
Invalid = 0,
Benign = 1,
Malware = 2,
Unknown = 3,
Grayware = 4,
NoConnection = 5