Adding Process\file global exceptions in XDR

[Daniel_Itenberg]

Hi, 

I want to add an exception for an in house app that the xdr keeps blocking. I tried adding a global exception as outlined here - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/exception... 

However I dont have the option to create an alert exception in the right click menu. I am an admin in our xdr. 

How can i create an exception?

[afurze]

Hi Daniel_Itenberg,

The context menu changes depending on the alert you select.  If the alert is a Behavioral Threat Protection (BTP) alert, you will have the "Create Alert Exception" option under Manage Alert.  If the alert is a Local Malware Analysis alert, you will have the "Add initiator SHA256 to Allow list" option under Manage Alert.  Can you please confirm the source of the alert and the alert name?  This will tell us what kind of alert you are trying to create an exception for.

[bbarmanroy]

The broadsword approach to the solution is to add it to the Global Allow List : https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-respo...

[Daniel_Itenberg]

I want to completely exclude examination of said process from all endpoints in my organisation. adding to the allow list dosent help because the sha256 is different everytime the program is run. I know there is a way to add global exceptions to the local malware analysis module, however there is no such option available to me, and that's what i need

[jcandelaria]

@Daniel_Itenberg 

Kindly refer to our webinar --> around 12:15 timeframe https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-alert-t...

[tech_noob]

After your Add initiator SHA256 to Allow list, can you still revert back if needed? Remove the SHA256 from the allow list?