topic Re: Cortex XDR - Detected (Scanned) alert for malware in Cortex XDR Discussions

Cortex XDR - Detected (Scanned) alert for malware

Joe_Botelho — Thu, 22 Apr 2021 05:45:37 GMT

Hello,

Please excuse me if these are very basic questions. I have been trying to find a definitive, written answer and have been unable to, so far.

1. Portable Executable and DLL Examination is set to the default of 'block' in an applied Cortex XDR policy,

2. a scan is run on an endpoint using that policy

and

3. a malicious executable is found on that device, why does the alert show as "Detected (Scanned)" for the file?

Is the endpoint protected from that malicious executable?

Based on the default setting, would that file be blocked if it attempted to execute and since it is dormant, it has only been identified during the scan but no action is necessary (other than an alert)?

Thank you for any help with this.

Re: Cortex XDR - Detected (Scanned) alert for malware

OrkanAlibayli — Thu, 22 Apr 2021 06:02:33 GMT

Hello ,

By default XDR don`t do anything malicious file ( if this file is not running). But you can quarantine this file ==> Endpoints/Policy Management/Profiles/Malware/Portable Executable and DLL Examination/QUARANTINE MALICIOUS EXECUTABLES

Re: Cortex XDR - Detected (Scanned) alert for malware

jcandelaria — Fri, 23 Apr 2021 07:18:23 GMT

a malicious executable is found on that device, why does the alert show as "Detected (Scanned)" for the file?

Detected (Scanned) means we detected the file as malware during the scan.

Is the endpoint protected from that malicious executable?

Yes, because the default policy is in block mode

yes it will be blocked, there is a setting to change quarantine malicious executable where you can change it to Quarantine Wildfire Malware verdict so that way file that is scanned and if it has WF malware verdict then it will be quarantined. Step 3 --> option 2 from the link below

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-profiles/add-malware-security-profile

Re: Cortex XDR - Detected (Scanned) alert for malware

Joe_Botelho — Thu, 06 May 2021 00:30:41 GMT

Thank you for the responses.

As a follow up, if a file is on the blocklist already but is given a WildFire verdict and "Quarantine WildFire malware verdict" has been enabled in the applied malware profile, why isn't the file actually quarantined? Is it due to it already being on the blocklist?

Re: Cortex XDR - Detected (Scanned) alert for malware

mabutbul — Tue, 11 May 2021 09:46:24 GMT

Hey @Joe_Botelho

The file should be moved to quarantine if the "Quarantine WildFire malware verdict" is flagged in the profile regardless of the fact it is in the block list.

In case it doesn't please do the following:

- validate the setting is enabled in the profile

- validate the profile the agent is getting

- open a support ticket to track the issue if none of the above works.

thanks