https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/allowed-application-still-blocked/m-p/597019#M7153 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/37384">@DopedWafer</a>, thanks for reaching us using the Live Community.</P> <P>&nbsp;</P> <P>The Allow Lists are useful in the pre-execution stage, for unwanted detections and blocks. Please add the "Module" column in the Alerts view to check what analysis module is blocking the software, then you can create a Disable Prevention Rule or a Legacy Agent Exception.</P> <P>I highly recommend to take a look at this webinar for Alert Tuning Part 1 and Part 2:&nbsp;<A href="https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-series-part-1-alert-tuning/ta-p/584842" target="_blank">https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-series-part-1-alert-tuning/ta-p/584842</A></P> <P>&nbsp;</P> <P>If this post answers your question, please mark it as the solution.</P> Thu, 05 Sep 2024 18:50:57 GMT jmazzeo 2024-09-05T18:50:57Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/allowed-application-still-blocked/m-p/596983#M7150 <P>Hello,</P> <P>&nbsp;</P> <P>I'm trying to allow a program, after whitelisting it is still blocked. Do I need to modify another rule to allow it?</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="DopedWafer_0-1725543583737.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/62063i07C3D467F67328EC/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="DopedWafer_0-1725543583737.png" alt="DopedWafer_0-1725543583737.png" /></span></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="DopedWafer_1-1725543750258.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/62064i167CA3C0CB4C67E1/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="DopedWafer_1-1725543750258.png" alt="DopedWafer_1-1725543750258.png" /></span></P> <P>&nbsp;</P> Thu, 05 Sep 2024 13:42:44 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/allowed-application-still-blocked/m-p/596983#M7150 DopedWafer 2024-09-05T13:42:44Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/allowed-application-still-blocked/m-p/597019#M7153 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/37384">@DopedWafer</a>, thanks for reaching us using the Live Community.</P> <P>&nbsp;</P> <P>The Allow Lists are useful in the pre-execution stage, for unwanted detections and blocks. Please add the "Module" column in the Alerts view to check what analysis module is blocking the software, then you can create a Disable Prevention Rule or a Legacy Agent Exception.</P> <P>I highly recommend to take a look at this webinar for Alert Tuning Part 1 and Part 2:&nbsp;<A href="https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-series-part-1-alert-tuning/ta-p/584842" target="_blank">https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-series-part-1-alert-tuning/ta-p/584842</A></P> <P>&nbsp;</P> <P>If this post answers your question, please mark it as the solution.</P> Thu, 05 Sep 2024 18:50:57 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/allowed-application-still-blocked/m-p/597019#M7153 jmazzeo 2024-09-05T18:50:57Z