topic Re: XDR Log and Quarantine Disk Space Retention in Cortex XDR Discussions

XDR Log and Quarantine Disk Space Retention

Marc_Denman — Tue, 14 Jun 2022 13:14:30 GMT

Hello-

Does anyone know the following details to how the product manages the retention for logs and quarantine?

I understand you can set the log quota to a specific size. This will leverage that on local disk. What I am not clear on are the following items.

What types of log data are included in this quota (some or all)?
How does the product "clean up" after itself? Is it possible the local disk could become full and I would have to manually clean up or is there a mechanism to perform this maintenance automatically?
How about the quarantine folder? Same type of question. Does it clean up automatically or require manual intervention to remove the files/logs?

Thanks in advance for sharing of your knowledge.

Re: XDR Log and Quarantine Disk Space Retention

bbarmanroy — Thu, 16 Jun 2022 02:47:18 GMT

HI @Marc_Denman

For your first question, you can refer to the documentation here which lists the data that is collected by XDR.

For your 2nd and 3rd question, they have been addressed earlier here.

To add on to the response in 3rd question: the reasoning behind quarantining is to typically isolate a file and block it from being executed on the endpoints. This gives the investigation team the time to conduct their analysis to determine whether the file is benign or malicious. If the file is benign, you can manually "un-quarantine" the file. Else, the file should be removed from the endpoint as per your organization's information security policies. XDR does not delete a file from the endpoint even after quarantining as it might affect business processes etc.

Re: XDR Log and Quarantine Disk Space Retention

AbdBgc — Fri, 30 Aug 2024 07:08:01 GMT

Hi @bbarmanroy,

Next question is: how?

In the File Quarantine Details list, or in the Incident/Alert View with a right click, there is only Restore but no (Permanently) Delete.

It is not easy directly on the enpoint as well. As the file is naturally moved from its original folder and renamed with random numbers in quarantine folder, how can one know which file is the right one?