Prevention Policy Rules Time to update?

Alexey_Didusenko — Thu, 28 Nov 2024 09:20:35 GMT

Hey,

I've configured a Prevention Policy Rules to apply on windows endpoints which have a tag = myname.
How long should it take to apply on these endpoints ?
For example if I go to "All endpoints" in the "Assigned Prevention Policy" I still see the old policy name applied .

How can I check locally on the endpoints which policy applied ? is there a registry key or some endpoint log ?

Re: Prevention Policy Rules Time to update?

nar — Tue, 03 Dec 2024 09:30:56 GMT

Hi @Alexey_Didusenko

Thanks for your query on LC!

The policy update should be instant or within agents next heartbeat-5mins if its applied correctly.

You can check the policy applied via cytool command -
Step 1 : Execute cytool command as follows
"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" persist print agent_settings.db
Step 2 : Extract a line starting with ' Admin profiles ' Admin profiles: {"tag": ....omit....}

After step 2, it is recommended to use text editor (like visual studio code) which can format the document.

Give it a like & mark as solution if this helped your query!

Best,

topic Prevention Policy Rules Time to update? in Cortex XDR Discussions

Prevention Policy Rules Time to update?

Re: Prevention Policy Rules Time to update?