Cortex Domain controllers exceptions

[Majid1Khan]

Hi Team,

We are having replication issues across the domain controllers and Microsoft is suspecting its an issue with Cortex and they want the the below files to be created as an exceptions across all our domain controllers.

To rule out Cortex issue we thought we will put this DC's in report mode instead of Block, as it is a risk of keeping DC's in report mode for longer duration till the replication is completed.

But im not able to add the below in the exclusions as it is not allowing this format in Cortex, please advise?

The following will need to be exception in Cortex AV. Once exceptioned and the list of files waiting to be replicated drops then Microsoft will investigate further.

SYSVOL Exceptions

$db_normal$

FileIDTable_*

SimilarityTable_*

*.xml

$db_dirty$

$db_clean$

$db_lost$

Dfsr.db

Fsr.chk

*.frx

*.log

Fsr*.jrs

Tmp.edb

[anlynch]

Hi @Majid1Khan,

I'm researching this issue for you now and will get back to you as quickly as I can.

[anlynch]

Hi @Majid1Khan,

I’ve taken a look at your list of exceptions received from Microsoft.  It appears that some of them are individual files/file types.  Others such as $db_normal$ appear to refer to a certain location on disk.  Looking at this Microsoft documentation I was able to find references to what you were given.

SYSVOL Exceptions

$db_normal$ - See below

FileIDTable_* - See below

SimilarityTable_* - See below

*.xml - File Type 

$db_dirty$ - See below

$db_clean$ - See below

$db_lost$ - See below

Dfsr.db - File Type

Fsr.chk - File Type

*.frx - File Type

*.log - File Type

Fsr*.jrs - File Type

Tmp.edb - File Type

In the screenshot above you can see a lot of the file types you mentioned in your previous post.  I hope this helps clarify the exceptions you would need to input into Cortex XDR.

Please reply to this comment if you have any further questions.  We’re happy to help.

Have a great day!