topic Re: Application WhiteListing in Cortex XDR Discussions

Application WhiteListing

jia_xuan — Thu, 06 Jun 2024 03:01:57 GMT

I have an application that needs whitelisting.

Actions Done:

Add to Allow List

Add to Malware Profile, under specific module that triggered alert/incident.

It is still showing up in incidents when executed. Any idea what could be going on?

Re: Application WhiteListing

aspatil — Thu, 06 Jun 2024 06:05:47 GMT

Hello @jia_xuan ,

Thank you for reaching out on Live Community.

Could you please confirm below:

1. Which Module is trigger alert?

2. What is the detection source, is it BPT, Local Analysis or Wildfire?

Re: Application WhiteListing

jia_xuan — Fri, 07 Jun 2024 00:31:14 GMT

1) Credential Gathering Protection

2) XDR Agent, Wildfire has marked detection benign.

Re: Application WhiteListing

aspatil — Fri, 07 Jun 2024 10:49:17 GMT

Hello @jia_xuan ,

Thank you for providing the information.

You can create an Alert Exclusion and add that to the profile instead of Global. Or take the execution script and create the Custom Prevention Rule or add it to Legacy agent exception.

Once it is done, retrieve the alert data and open a TAC to check the reputation.

Hope this helps.

Regards