topic Re: On-write Protection is disabled by default in Cortex XDR Discussions

On-write Protection is disabled by default

SeanDeHarris — Tue, 16 Apr 2024 04:39:17 GMT

Hi everyone,

Just wondering how's the performance or resource is impacted when this protection is on, i bet it would have certain impact as this is "Disabled" by default. or any other concerns if ON?

Any experience to share?

thanks

Re: On-write Protection is disabled by default

jmazzeo — Wed, 17 Apr 2024 15:35:13 GMT

Hi @SeanDeHarris, thanks for reaching us using the Live Community.

The on-write protection should not generate too much impact on the endpoints, because this module only starts a scan when the written file is an executable or a script. The scan workflow is the same when a file is executed, first it will ask to Wildfire about the reputation, and if the reputation is good, no other scan will be executed.

If you want to test if first, I'll recommend you to create a new malware profile, enable this feature, and assign it to a group of endpoints to monitor the performance behavior.

If this post answers your question, please mark it as the solution.

Re: On-write Protection is disabled by default

AbdBgc — Mon, 22 Apr 2024 13:51:16 GMT

Hi @jmazzeo

When one reads the name of the module, normally comes to mind every kind of file writing events, not only the executables or scripts. Couldn't find the exact info about it in the docus. Do you have a link to the source of this info, where perhaps I can get more also on other modules?

Thanks in advence.

Re: On-write Protection is disabled by default

jmazzeo — Mon, 30 Dec 2024 20:46:36 GMT

This is what we can share about the On-Write file protection file types and some other useful information:

- File types: DLL, PE and Macro

- Exceptions: add affected path to the blocking module.

If this post answers your question, please mark it as the solution.

Re: On-write Protection is disabled by default

AbdBgc — Wed, 24 Apr 2024 05:56:22 GMT

Thanks @jmazzeo , this is helpful.👍

As far as I see, even as admin I have only the option to turn it on or off, Enabled/Disabled, in Malware Prevention Profile from the Console. So, no option to use this protection type in monitoring only mode (no "Report" only option), if enabled it will detect and prevent in any case. Is that correct?

Re: On-write Protection is disabled by default

jmazzeo — Wed, 24 Apr 2024 12:42:58 GMT

That toggle is to enable the ability to send the written files to analysis. The actions are made by the usual modules as is mentioned in the last bullet on the screenshot.