Agent Blocking files/processes dynamically based on conditions

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Agent Blocking files/processes dynamically based on conditions

L3 Networker

Hello XDR Enthusiasts,

I am working with multiple XDR Tenants and would like to block a file/process based on conditions. I understand that you can use the Prevention features to block files based on a block/black list. This can also be configured on the Malware Profile settings where specific severity incidents can induce the agent to block the file automatically.  My question is; Is it possible to configure conditions for the Agent to stop a file? For example only when a filename does not equal X then block it? 

I thought of two solutions, yet I am not sure that they will be suitable;

  1. To create a BIOC rule with a critical severity or similar in order that the block rule can be determined on policy based on its severity. I am not sure that the XDR has this capability. 
  2. I am working with a Production Level Cortex XSOAR, is there a playbook or automation that can be implemented to block the file during it's runtime? Due to the time delta between the agent identifying and the XSOAR running a playbook there will be a delay.

I would be interested to know whether the XDR Agent blocking abilities can be set to default based on rules. 

Many thanks,

MR

Cortex XSOAR 

Cortex XDR 

1 REPLY 1

L5 Sessionator

Hi @michaelsysec242 the ability to create custom BIOC to terminate an execution should do the trick. Please look into this LiveCommunity post where the solution has been explained.

  • 1020 Views
  • 1 replies
  • 0 Likes
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!