topic Re: Cortex XDR whitelisting in Cortex XDR Discussions

Cortex XDR whitelisting

MCereda — Wed, 21 Apr 2021 09:27:21 GMT

Hi,

We have been asked to whitelist a specified folder in order to disable any kind of real-time checks and analysis made by Cortex XDR.

So, we added the aforementioned folder in the allow lists of "Portable Executable and DLL Examination" and "Behavioral Threat Protection" sections in "Malware profile" configuration.

With this kind of configuration enabled what are Cortex XDR real-time checks that remain active?

Re: Cortex XDR whitelisting

fmoixsante — Wed, 21 Apr 2021 10:08:10 GMT

Hi @MCereda ,

You still have Child Process Protection, Office files with Macros and Ransomware.

I need to point out that active whitelisting is NOT really recommended except for "Portable Executable and DLL Examination" as Local Analysis could indeed block legit applications, and it could take WF up to 10-15 minutes to provide a benign verdict.

The other modules have different kind of protections and I would only recommend whitelisting whenever there is a false positive alert.

You need to monitor your incidents/alerts and see which modules are blocking your "legit" applications.

Re: Cortex XDR whitelisting

MCereda — Wed, 21 Apr 2021 12:03:38 GMT

Hi @fmoixsante,

thank you for the answer.

As we have been asked us to temporarily disable any kind of real-time checks and analysis made by Cortex XDR on a specified folder in order to test a performance issue, do you know how to completely disable Cortex XDR features for a single folder?

Re: Cortex XDR whitelisting

fmoixsante — Wed, 21 Apr 2021 12:09:18 GMT

Hi @MCereda ,

You can whitelist folders for almost every malware module, except for Ransomware and Password Theft Protection.

For the Exploit module, disabling protections for a single folder is not supported as far as I know. As of now, there is no way to do that directly from the Exploit module. I would suggest contacting TAC and ask them if a Support Exception (SUEX) would be able to achieve what you want to do.