Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

block vulnerable applications from running

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

block vulnerable applications from running

L0 Member

Hi community,

 

I am attempting with restricting the execution of vulnerable applications.

 

Is it possible to block a specific application version using BIOC associated with restriction profile?
(Or if there's another easy way to do this please let me know)

1 accepted solution

Accepted Solutions

L2 Linker

Hi @Hisashi_Abe 

Thank you for reaching out to the Live community!


You can use the restriction profile and call the executable/application there - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-R...

In case if you are looking to block the specific version of that application then you may need to check the hash of that version which may be unique with each release so that you can add it to the block list - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-File...

For more granular restriction you can check for other parameters/variables of that application and make use of BIOC rules by adding them to the restriction profile.

Please click Accept as Solution to acknowledge If this answer added value to your question.

View solution in original post

1 REPLY 1

L2 Linker

Hi @Hisashi_Abe 

Thank you for reaching out to the Live community!


You can use the restriction profile and call the executable/application there - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-R...

In case if you are looking to block the specific version of that application then you may need to check the hash of that version which may be unique with each release so that you can add it to the block list - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-File...

For more granular restriction you can check for other parameters/variables of that application and make use of BIOC rules by adding them to the restriction profile.

Please click Accept as Solution to acknowledge If this answer added value to your question.

  • 1 accepted solution
  • 369 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!