topic Re: Automatic deletion of files suspected/confirmed as malware in Cortex XDR Discussions

Automatic deletion of files suspected/confirmed as malware

Daniel_Itenberg — Mon, 22 Nov 2021 09:06:31 GMT

Hi all,

Can the XDR auto delete files it has flagged, be it by local analysis or wildfire analysis? Or does it just block and quarantine files?

Re: Automatic deletion of files suspected/confirmed as malware

P.Jacob — Mon, 22 Nov 2021 15:13:28 GMT

looks like in the new v3.1 version you can do this:

Permanently Delete Quarantined files

(Requires a Cortex XDR agent 7.6 or a later release for Windows)

To help you better manage malicious files which have been quarantined and avoid any potential mistake of restoring unwanted files, you can now permanently delete quarantined files on the endpoint from the File Quarantine Details page.

Re: Automatic deletion of files suspected/confirmed as malware

aaminahassan — Tue, 02 May 2023 07:04:43 GMT

Hey! I want to ask more about it. whats the API call to delete file other than quarantine file API at end point.

Re: Automatic deletion of files suspected/confirmed as malware

PiyushKohli — Wed, 03 May 2023 05:12:23 GMT

Hi @aaminahassan

Regarding your use case above i.e. api call to delete file. You may run script using api to delete a file. There is a python script with name "delete_file" under Script library which you can locate at (Incident Response -> Response -> Action Center -> Agent Script Library). Using the api you may mention the file path of the file which needs to be deleted.

Screenshot for reference:

API Ref: https://cortex-panw.stoplight.io/docs/cortex-xdr/3675bfc1e315e-run-script

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.

Re: Automatic deletion of files suspected/confirmed as malware

aaminahassan — Wed, 03 May 2023 05:20:50 GMT

Thanks for the prompt response.
Also please share the way out to whitelist USB using which API call? Under device control I can see only get_violations. I can get_violations of device but don't know the exact parameters/API end point to whitelist the device.

Re: Automatic deletion of files suspected/confirmed as malware

tlmarques — Mon, 22 Apr 2024 14:40:53 GMT

where you found this scripts??