topic Re: File server, backup server and storage server profiles in Cortex XDR Discussions

File server, backup server and storage server profiles

MCereda — Wed, 28 Apr 2021 14:53:28 GMT

Hi,

we are about to activate Cortex XDR agent with Default Policy Rules (i.e. Default Exploit, Malware, Restrictions, Agent settings and Exceptions profiles) on some Windows servers which contain a huge amount of data (terabytes).

Are there some recommended best practices to follow or some functionalities that should be disabled in order to avoid any kind of impact on these kind of servers in terms of performances?

For example, we were told that "File Search and Destroy" feature could cause a huge overhead for some time after the agent has been activated.

Furthermore, can anyone provide an estimate of how long a Cortex XDR malware scan on 1 TB of data might take?

Thanks in advance.

Re: File server, backup server and storage server profiles

gjenkins — Tue, 04 May 2021 18:55:04 GMT

@MCereda wrote:
Hi,

we are about to activate Cortex XDR agent with Default Policy Rules (i.e. Default Exploit, Malware, Restrictions, Agent settings and Exceptions profiles) on some Windows servers which contain a huge amount of data (terabytes).

Are there some recommended best practices to follow or some functionalities that should be disabled in order to avoid any kind of impact on these kind of servers in terms of performances?
For example, we were told that "File Search and Destroy" feature could cause a huge overhead for some time after the agent has been activated.

Furthermore, can anyone provide an estimate of how long a Cortex XDR malware scan on 1 TB of data might take?

Thanks in advance.

Hi @MCereda ,

As I understand it, you're planning to deploy the Cortex XDR to a Windows server that houses a considerable amount of data. There are some considerations to make:

Install the Cortex XDR agent during a maintenance window.
After the installation, prepare for an immediate malware scan to follow.
Schedule scans during off-periods when the server will not be in use as described here.

Note: Subsequent scans will be faster as the agent will not rescan unmodified files.

As for the amount of time that a scan could take, this is variable depending upon the system resources available and the size of the file, so there's no way to provide an estimate at this time. Predicting an estimated amount to scan a target fully would be an excellent feature, which should be submitted as a feature request for future consideration.

Finally, Search and Destroy performs a hash match in the cloud for all devices noted to have a file with that hash on the endpoint (Search). Then it sends a delete job to remove the target file from the filesystem on the target endpoint (Destroy). There's no major resource utilization expected on the endpoint during this process, as the endpoint will only be tasked with deleting the target file if it exists.

Re: File server, backup server and storage server profiles

mabutbul — Tue, 11 May 2021 09:57:46 GMT

Hey @MCereda

If those are production servers I will suggest deploying the agents with a profile configured to 'Report' instead of Block, give it a week to collect alerts and activities from those servers, and monitor the triggered alerts on the hosts. in case you are seeing FP's perform the appropriate exclusions and once you feel comfortable with moving to 'Block' mode please do so.

Thanks,