topic Multiple Paths in Disable Prevention Rules in Cortex XDR Discussions

Multiple Paths in Disable Prevention Rules

PatrykDebski — Mon, 10 Jun 2024 12:16:21 GMT

Hello
Is it possible to specify multiple values while creating prevention rules exception for one "application" ? If so what is the schematics of adding those ?
Especially in path section. As if application has multiple location paths for its different modules such as C:\program files (x86)\ or %program data% or C:\program files\ etc where wild card can not be used.
Or in this case multiple rules have to be created based on those paths.

Thank you.

Re: Multiple Paths in Disable Prevention Rules

PatrykDebski — Mon, 10 Jun 2024 12:24:24 GMT

screenshot added.

Re: Multiple Paths in Disable Prevention Rules

mavega — Mon, 10 Jun 2024 18:58:42 GMT

Hi,

Thanks for reaching out.

Have you tried adding the file hash of the trusted app to the allow list instead instead?

Test it out https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Manage-File-Execution

If this post answers your question, please mark it as the solution.