topic Re: How to Effectively Restrict Specific Files Across All Locations in Cortex XDR? in Cortex XDR Discussions

How to Effectively Restrict Specific Files Across All Locations in Cortex XDR?

J.X570892 — Thu, 19 Dec 2024 12:34:51 GMT

I am facing a challenge in Cortex XDR regarding file restrictions. When we need to block a specific file on endpoints, we add its file path to the restriction profile. This effectively blocks users from accessing or opening the file in the specified location.

However, the issue arises when a user copies the restricted file and pastes it into a different location. In this new location, they can access and open the file without any restrictions.

Is there a way to ensure that such files are blocked universally, regardless of their location on the endpoint? Any insights or best practices to address this scenario would be greatly appreciated.

Re: How to Effectively Restrict Specific Files Across All Locations in Cortex XDR?

mavega — Thu, 19 Dec 2024 14:20:35 GMT

Hi,

Thanks for reaching Live Community.

If you want to block a specific file from all your endpoint, I believe the best option is to add the hash in the block list.

You can review this here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-File-Execution

If this post answers your question, please mark it as solution.

Re: How to Effectively Restrict Specific Files Across All Locations in Cortex XDR?

RFeyertag — Fri, 20 Dec 2024 18:45:30 GMT

Is blocking the best way? What about alerting, if a user reads or moves it? And if, than...

Rob

Re: How to Effectively Restrict Specific Files Across All Locations in Cortex XDR?

maximk — Fri, 20 Dec 2024 18:58:08 GMT

If it's digitally signed, I would block by the signer via Restriction profile. Otherwise by sha256 via blocklist.

Re: How to Effectively Restrict Specific Files Across All Locations in Cortex XDR?

VarunPitale — Tue, 24 Dec 2024 06:57:24 GMT

Can you add it as a fileName as well as hash value in the IOC and then add that IOC to the Restriction Profile?