08-19-2022 07:32 AM
Bit of a weird one but has anyone experienced issues with office add ins that uses the clipboard functionality?
seem to be having intermittent errors with it and it just straight up not working.
Tried removing the cortex agent from one or two systems and it seemed to have restored clipboard functionality to the add in, one still did continue with errors after it was removed though.
I cant see any logs in cortex that would suggest it was blocking this so I am not 100% sure cortex is causing the issue but i just thought i would ask here and see if anyone had anything similar.
Agent version is 7.7.8
08-21-2022 01:05 AM
Thanks @jruck for update.
TAC team will help you further to resolve the issue.
I hope my suggestion above helped to address your concern.
Please mark it as solution if you found it helpful.
08-21-2022 06:32 AM
Hi @creddy ,
For a quick test, what we can ask you is to add clipboard.exe to global/profile process exception(as per your choice) and select all modules under Module names. See how to do it below:
Once you have done that, you can try to enable modules one by one and checking which module makes an issue for you. Collect the support files and send it to the TAC for the fix.
Generally this can probably happen with exploits module. Ensure you have no other security solution running beside Cortex XDR which has similar exploit abilities like Cortex.
08-22-2022 06:53 AM
Sorry yes that was a typo i am using version 18.104.22.168264, i tried to make exception for clipboard.exe with all modules selected but to no avail and re-installing the agent didn't help either.
Only thing that worked was either removing the agent or dropping it down to 7.7.2.
I have opened a support case and currently awaiting to hear back.
08-22-2022 07:00 AM
Thank you so much for your response and efforts. I am sure your issue would be in good hands with Palo Alto Networks support. Please let us know the final findings and we shall be happy to suggest workarounds for future used cases like these.
08-22-2022 07:14 AM
Support gave us a Support Exception to apply to the endpoints that has resolved the issue clipboard for now until a fix is available.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!