topic Re: Disable notification in user agent in Cortex XDR Discussions

Disable notification in user agent

s.martin720094 — Mon, 13 Jan 2025 12:17:51 GMT

Hello,
I have an exception rule on a file that is being applied correctly. The file executes because of this exception, but in the user agent you get a warning that an unusual activity has been encountered or that a malicious activity has been encountered even though the file executes.
How can you prevent the user from getting this notification?

Thank you

Re: Disable notification in user agent

jmazzeo — Wed, 15 Jan 2025 17:14:42 GMT

Hi @s.martin720094, thanks for reaching us using the Live Community.

What type of exception have you created? Have you selected all the modules that generates the alert in the configuration?

Re: Disable notification in user agent

s.martin720094 — Fri, 17 Jan 2025 09:38:21 GMT

Hi, I have an exception made in:
Legacy Agent Exceptions at executable file signature level.
Malware > Portable Executable and DLL Examination

Another exception in: Disable Prevention Rules in the following modules:

DLL Security, DEP, Null Deflection Protection, Memory Limit Heap Spray Check, Execution Protection, Media Control, Child Process, SEH Protection, ROP Mitigation, Source Protection, DLL Hijack Protection, Hot Patch Protection, Shell Link Protection, WildFire, Shellcode Preallocation, Library Preallocation, Exception Heap Spray Check, WildFire Post Detection, CPL Execution Protection, JIT Mitigation, Exception System Exit Check, Hash Control, Local Analysis, WildFire - Grayware, Kernel Privilege Escalation Protection, Exploit Kit Fingerprinting Protection, Child Process Protection, Anti-Ransomware Protection, APC Guard, Behavioral Threat Protection, Digital Signer Restriction, MBR Protection, Java Deserialization Protection, Network Packet Inspection Engine, Threat Intelligence Management, Anti Webshell Protection, Credential Gathering Protection, Financial Malware Threat Protection, Cryptominers Protection, In-process shellcode Protection, Malicious Device Prevention, UAC Bypass Prevention, Anti Tampering Protection, IIS Protection, UEFI Protection

Thanks