Automatic deletion of files suspected/confirmed as malware

[Daniel_Itenberg]

Hi all, 

Can the XDR auto delete files it has flagged, be it by local analysis or wildfire analysis? Or does it just block and quarantine files?

[PeteJacobCF]

looks like in the new v3.1 version you can do this:

Permanently Delete Quarantined files (Requires a Cortex XDR agent 7.6 or a later release for Windows)

To help you better manage malicious files which have been quarantined and avoid any potential mistake of restoring unwanted files, you can now permanently delete quarantined files on the endpoint from the File Quarantine Details page.

[aaminahassan]

Hey! I want to ask more about it. whats the API call to delete file other than quarantine file API at end point. 

[PiyushKohli]

Hi @aaminahassan 

Regarding your use case above i.e. api call to delete file. You may run script using api to delete a file. There is a python script with name "delete_file" under Script library which you can locate at (Incident Response -> Response -> Action Center -> Agent Script Library). Using the api you may mention the file path of the file which needs to be deleted.

Screenshot for reference:

API Ref: https://cortex-panw.stoplight.io/docs/cortex-xdr/3675bfc1e315e-run-script

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.

[aaminahassan]

Thanks for the prompt response.
Also please share the way out to whitelist USB using which API call? Under device control I can see only get_violations. I can get_violations of device but don't know the exact parameters/API end point to whitelist the device.