topic Re: Cortex XDR on Windows blocks Ansible in Cortex XDR Discussions

Cortex XDR on Windows blocks Ansible

NicolasBriche — Fri, 10 Jan 2025 15:05:21 GMT

Hello all,

I'm trying to switch to Ansible for my Windows application deployments (among other things), but Cortex XDR blocks everything Ansible tries to do with a Behavioral Threat response (it works via powershell.exe -EncodedCommand).

What are the best practices for using Ansible on an endpoint protected by Cortex XDR?

Re: Cortex XDR on Windows blocks Ansible

nar — Wed, 15 Jan 2025 09:43:02 GMT

Hi @NicolasBriche

Thanks for writing to LC!

Ideally, if the activity is legit, the agent should not block it. It seems that the XDR agent may be seeing that as obfuscated activity hence blocking it.
In this case, its better we understand how you are running them and what BTP module is doing the detecting to have an appropriate exceptions created hence I suggest raising a ticket to TAC team to have the alert data investigated for most feasible exceptions.(TAC would suggest the exceptions for that specific use case).

Give it a like & mark as solution if this helped.

Best,

Re: Cortex XDR on Windows blocks Ansible

NicolasBriche — Wed, 15 Jan 2025 09:53:23 GMT

Thank you @nar , I'll see with our Palo liaison to open a ticket.

Regards,