topic Re: Cortex scan in Endpoint (Traps) Discussions https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592689#M1163 <P>Thank again&nbsp;</P> <P>&nbsp;For Security Operations, only see Retiveve Endpoint Files, &amp; Initiate Live Terminal</P> <P>&nbsp;</P> Mon, 22 Jul 2024 22:53:26 GMT CharlesBurch1 2024-07-22T22:53:26Z Cortex scan https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592677#M1159 <P>how do i run a full scan on an endpoint</P> <P>&nbsp;</P> Mon, 22 Jul 2024 21:40:24 GMT https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592677#M1159 CharlesBurch1 2024-07-22T21:40:24Z Re: Cortex scan https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592684#M1160 <P>Go to the Action Center &gt; New Action &gt; Malware Scan.</P> <P>Then select the endpoints you want to scan.</P> <P>&nbsp;</P> <P><A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Scan-an-Endpoint-for-Malware?section=UUID-3434669a-2cee-0b9d-b511-60f401d4b958_id7029a0de-63d7-48d6-b941-993968759407" target="_blank">Scan an Endpoint for Malware • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal</A></P> Mon, 22 Jul 2024 22:22:42 GMT https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592684#M1160 jmoscoso1 2024-07-22T22:22:42Z Re: Cortex scan https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592686#M1161 <P>When I click <SPAN>Select&nbsp;</SPAN><SPAN class="guimenu">Incident Response</SPAN><SPAN>&nbsp;→&nbsp;</SPAN><SPAN class="guisubmenu">Response</SPAN><SPAN>&nbsp;→&nbsp;</SPAN><SPAN class="guisubmenu">Action Center</SPAN><SPAN>&nbsp;→&nbsp;</SPAN><SPAN class="guimenuitem">+New Action</SPAN><SPAN>.</SPAN></P> <P><SPAN>All I see</SPAN></P> <P class="subtitle">ACTIONS</P> <DIV class="menu-container"> <DIV id="FILES_RETRIEVAL" class="item-wrapper ng-star-inserted"><BUTTON class="label-container active" type="button"><BUTTON class="label-container active" type="button"><SPAN class="xdr-sr-only ng-star-inserted">action files retrieval</SPAN></BUTTON></BUTTON> <DIV class="titles-container"> <DIV class="main-title">Files Retrieval</DIV> <DIV class="sub-title" title="Retrieve files from an endpoint">Retrieve files from an endpoint</DIV> </DIV> </DIV> <DIV id="RETRIEVE_ENDPOINT_DATA" class="item-wrapper ng-star-inserted"><BUTTON class="label-container" type="button"><BUTTON class="label-container" type="button"><SPAN class="xdr-sr-only ng-star-inserted">action retrieve support file</SPAN></BUTTON></BUTTON> <DIV class="titles-container"> <DIV class="main-title">Retrieve Support File</DIV> <DIV class="sub-title" title="Upload extended agent log file">Upload extended agent log file</DIV> </DIV> </DIV> <DIV id="AGENT_UPGRADE" class="item-wrapper ng-star-inserted"><BUTTON class="label-container" type="button"><BUTTON class="label-container" type="button"><SPAN class="xdr-sr-only ng-star-inserted">action upgrade</SPAN></BUTTON></BUTTON> <DIV class="titles-container"> <DIV class="main-title">Agent Upgrade</DIV> <DIV class="sub-title" title="Upgrade XDR agent version">Upgrade XDR agent version</DIV> </DIV> </DIV> <DIV id="AGENT_UNINSTALL" class="item-wrapper ng-star-inserted"><BUTTON class="label-container" type="button"><BUTTON class="label-container" type="button"><SPAN class="xdr-sr-only ng-star-inserted">action uninstall</SPAN></BUTTON></BUTTON> <DIV class="titles-container"> <DIV class="main-title">Agent Uninstall</DIV> <DIV class="sub-title" title="Uninstall XDR agent">Uninstall XDR agent</DIV> <DIV class="sub-title" title="Uninstall XDR agent">&nbsp;</DIV> <DIV class="sub-title" title="Uninstall XDR agent">Is this because I do not have permission to run a scan?</DIV> </DIV> </DIV> </DIV> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 22 Jul 2024 22:32:46 GMT https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592686#M1161 CharlesBurch1 2024-07-22T22:32:46Z Re: Cortex scan https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592688#M1162 <P>Maybe you have remediation or response actions disabled for your user.</P> <P>&nbsp;</P> <P>You can also try going to Endpoints &gt; All Endpoints &gt; Search for the endpoint you want to scan &gt; right click &gt; Security Operations &gt; Initiate Malware Scan</P> Mon, 22 Jul 2024 22:46:13 GMT https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592688#M1162 jmoscoso1 2024-07-22T22:46:13Z Re: Cortex scan https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592689#M1163 <P>Thank again&nbsp;</P> <P>&nbsp;For Security Operations, only see Retiveve Endpoint Files, &amp; Initiate Live Terminal</P> <P>&nbsp;</P> Mon, 22 Jul 2024 22:53:26 GMT https://live.paloaltonetworks.com/t5/endpoint-traps-discussions/cortex-scan/m-p/592689#M1163 CharlesBurch1 2024-07-22T22:53:26Z