Cortex XDR file quarantine

O.Asha — Tue, 01 Jul 2025 08:21:46 GMT

Hi Team,

i have two general questions,

1-can i delete a file from multiple endpoints but with different paths from the action centre?

2- i understand that cortex can quarantine a malicious file but is there an option to delete it without my interference?

Re: Cortex XDR file quarantine

eluis — Tue, 01 Jul 2025 14:52:01 GMT

Hi Oasha,

Answering your questions:

You can use the feature search and destroy files at the Action Center. If you search and destroy by hash, that file will be deleted no matter the path where it is located and even if there are more than one copy of that file at the same endpoint, it will delete it. The agents make a scan once they are installed and keep a database of files with hashes, paths etc.. so every Agent will know where to find that file if it exists.
Please you can use the doc for more info:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Search-and-destroy-malicious-files
Related to delete the malicious files without confirmation by the user: At profiles configuration, and specifically Malware Profiles, you will see a different area of configuration options for every malware protection module. There you can choose block mode in one option and in another you can choose quarantine enabled or disabled. If you use block mode and quarantine disabled, the malicious files will be blocked but not deleted, so you need to use the File Search and Destroy feature mentioned on the previous answer.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis