topic Protection Mode for Linux Modules in Cortex XDR Discussions https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/protection-mode-for-linux-modules/m-p/1257755#M9404 <P>When configuring&nbsp;Reverse Shell Protection and&nbsp;<SPAN class="frame-title">Malicious Child Process Protection there's an option to configure the protection mode. Default is "normal" but we could choose "aggressive" too.</SPAN></P> <P><SPAN class="frame-title">There's no documentation.</SPAN></P> <P>&nbsp;</P> <P><SPAN class="frame-title">Does anyone know the difference of protection modes for these Linux modules?</SPAN></P> <P>Is it the same as in the ransomware protection module for Windows?</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="micomi_0-1782802979178.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/71905i91BB639FCE2F5F6C/image-size/medium?v=v2&amp;px=400" role="button" title="micomi_0-1782802979178.png" alt="micomi_0-1782802979178.png" /></span></P> <P>&nbsp;</P> Tue, 30 Jun 2026 07:03:09 GMT micomi 2026-06-30T07:03:09Z Protection Mode for Linux Modules https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/protection-mode-for-linux-modules/m-p/1257755#M9404 <P>When configuring&nbsp;Reverse Shell Protection and&nbsp;<SPAN class="frame-title">Malicious Child Process Protection there's an option to configure the protection mode. Default is "normal" but we could choose "aggressive" too.</SPAN></P> <P><SPAN class="frame-title">There's no documentation.</SPAN></P> <P>&nbsp;</P> <P><SPAN class="frame-title">Does anyone know the difference of protection modes for these Linux modules?</SPAN></P> <P>Is it the same as in the ransomware protection module for Windows?</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="micomi_0-1782802979178.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/71905i91BB639FCE2F5F6C/image-size/medium?v=v2&amp;px=400" role="button" title="micomi_0-1782802979178.png" alt="micomi_0-1782802979178.png" /></span></P> <P>&nbsp;</P> Tue, 30 Jun 2026 07:03:09 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/protection-mode-for-linux-modules/m-p/1257755#M9404 micomi 2026-06-30T07:03:09Z