Automatic deletion of files suspected/confirmed as malware

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Automatic deletion of files suspected/confirmed as malware

L2 Linker

Hi all, 

Can the XDR auto delete files it has flagged, be it by local analysis or wildfire analysis? Or does it just block and quarantine files?


L3 Networker

looks like in the new v3.1 version you can do this:

Permanently Delete Quarantined files
(Requires a Cortex XDR agent 7.6 or a later release for Windows)
To help you better manage malicious files which have been quarantined and avoid any potential mistake of restoring unwanted files, you can now permanently delete quarantined files on the endpoint from the File Quarantine Details page.

L1 Bithead

aaminahassan_0-1683011031186.pngHey! I want to ask more about it. whats the API call to delete file other than quarantine file API at end point. 


Hi @aaminahassan 


Regarding your use case above i.e. api call to delete file. You may run script using api to delete a file. There is a python script with name "delete_file" under Script library which you can locate at (Incident Response -> Response -> Action Center -> Agent Script Library). Using the api you may mention the file path of the file which needs to be deleted.


Screenshot for reference:



API Ref:


Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.


Thanks for the prompt response.
Also please share the way out to whitelist USB using which API call? Under device control I can see only get_violations. I can get_violations of device but don't know the exact parameters/API end point to whitelist the device.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!