topic Re: Scanning Linux host, only scans a portion of the FS in Cortex XDR Discussions

Scanning Linux host, only scans a portion of the FS

Panagiss — Tue, 11 Mar 2025 10:04:26 GMT

Hello there,

I recently initiated a Malware scan on a linux host and when I went to see the results I see that it seems that it scan only two dirs (/opt, /usr) only.
Why is that the case?

The host has more directories of course and there are multiple filesystems that are mounted on
Lastly, I don't see any connection between the two.

Re: Scanning Linux host, only scans a portion of the FS

aspatil — Tue, 11 Mar 2025 11:47:23 GMT

Hello @Panagiss ,

Please check the malware profile assigned to the Linux server.

Endpoint scanning is enabled by default on the following : /etc, /tmp, /home, /usr, /bin, /sbin, /lib, /var, /opt, /dev, /root, /boot.

Check whether any directories are configured in allow list and also the directories in the Server itself.

You may open TAC case if you have any concern.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: Scanning Linux host, only scans a portion of the FS

Panagiss — Wed, 12 Mar 2025 10:05:26 GMT

The Profile that I have set includes the default as you mention and image you send is the same as mine. But still when I performed the scan I saw it scanning only two dirs.