Help regarding disk encryption visibility of cortex xdr

AakashShinde — Fri, 12 Apr 2024 06:43:41 GMT

Could you please provide any documentation regarding Disk encryption in Cortex XDR? I would like to know if we need to manually enable BitLocker or if it can be enabled automatically by pushing the host disk encryption policy to all endpoints. Also, where are the BitLocker keys stored? Does Cortex XDR have BitLocker keys for every endpoint?

Re: Help regarding disk encryption visibility of cortex xdr

aspatil — Mon, 15 Apr 2024 06:56:06 GMT

Hello @AakashShinde ,

Thanks for reaching out on LiveCommunity!

XDR doesn't execute the disk encryption it leverages the operating system tools to enforce compliance. For Windows Bitlocker is used and for macOS it is file vault. For Windows the bitlocker keys need to be stored in Active Directory and Group Policy should be used to control the policies.

The Cortex XDR Disk Encryption profile for Mac can encrypt the endpoint disk, however, it cannot decrypt it. After you disable the Cortex XDR policy rule on the endpoint, you can decrypt the endpoint manually.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Disk-Encryption

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

topic Re: Help regarding disk encryption visibility of cortex xdr in Cortex XDR Discussions

Help regarding disk encryption visibility of cortex xdr

Re: Help regarding disk encryption visibility of cortex xdr