topic how remove softwares with XDR in Cortex XDR Discussions

how remove softwares with XDR

tlmarques — Fri, 06 Dec 2024 18:46:50 GMT

Hello,
I've two questions.

First, I would like to know about your experience. How do you handle uninstalling software on specific devices that are not allowed and need to be removed via Cortex XDR without the user noticing?

The second question is: Is it possible to block apps? For example, I don’t want users to install Wireshark. Can it be blocked

Re: how remove softwares with XDR

jmazzeo — Fri, 06 Dec 2024 19:50:32 GMT

Hi @tlmarques, thanks for reaching us using the Live Community.

Both use cases are not supported as an OOTB feature, as the XDR solutions aims to prevent malware and alert on suspicious behavior in processes (and many etcetera).

Anyway, it can be achieved with workarounds like running custom scripts for the first case, and creating custom BIOC rules to block the Wireshark executable by signer.

If this post answers your question, please mark it as the solution.

Re: how remove softwares with XDR

tlmarques — Mon, 09 Dec 2024 14:30:00 GMT

Hi @jmazzeo thnks for your help.

In my company, we have issues with some users installing prohibited applications (e.g., Chrome, Wireshark). I want to either remove these apps or create a policy to block them every time they are launched.

Is it possible to create a BIOC rule and apply it to specific groups? Or would it be better to use an XQL query to exclude endpoints by name using the initiator field?

Re: how remove softwares with XDR

tlmarques — Mon, 09 Dec 2024 15:40:27 GMT

i've solved the exexcution with this:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000XgyMCAS

Re: how remove softwares with XDR

jmazzeo — Mon, 09 Dec 2024 15:46:19 GMT

That's great, that is the approach I mentioned in my previous post, using BIOC rules.

You can apply the Restriction Profiles with the BIOC rules assigned to block to any different Endpoint Groups that you can configure from the console, or you can use your directory OUs or Groups (if applies) using the CIE integration.