clipboard functionality

[KarlHalpin]

Hi Guys,

Bit of a weird one but has anyone experienced issues with office add ins that uses the clipboard functionality?

seem to be having intermittent errors with it and it just straight up not working.

Tried removing the cortex agent from one or two systems and it seemed to have restored clipboard functionality to the add in, one still did continue with errors after it was removed though.

I cant see any logs in cortex that would suggest it was blocking this so I am not 100% sure cortex is causing the issue but i just thought i would ask here and see if anyone had anything similar.

Agent version is 7.7.8

[creddy]

Thanks @jruck for update.
TAC team will help you further to resolve the issue.
I hope my suggestion above helped to address your concern.
Please mark it as solution if you found it helpful.
Thank you!

[neelrohit]

Hi @creddy ,

For a quick test, what we can ask you is to add clipboard.exe to global/profile process exception(as per your choice) and select all modules under Module names. See how to do it below:

(https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POLaCAO

Once you have done that, you can try to enable modules one by one and checking which module makes an issue for you. Collect the support files and send it to the TAC for the fix. 

Generally this can probably happen with exploits module. Ensure you have no other security solution running beside Cortex XDR which has similar exploit abilities like Cortex.

https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/cortex-xdr-compatibility-with-thir...

[KarlHalpin]

Hi @creddy,

Sorry yes that was a typo i am using version 7.8.0.64264, i tried to make exception for clipboard.exe with all modules selected but to no avail and re-installing the agent didn't help either.

Only thing that worked was either removing the agent or dropping it down to 7.7.2.

I have opened a support case and currently awaiting to hear back.

[neelrohit]

@creddy ,

Thank you so much for your response and efforts. I am sure your issue would be in good hands with Palo Alto Networks support. Please let us know the final findings and we shall be happy to suggest workarounds for future used cases like these.

[jruck]

Support gave us a Support Exception to apply to the endpoints that has resolved the issue clipboard for now until a fix is available.