Cortex XDR Delete Malware

[PKhemarith]

Hello 

i see alert malware in incident report . how i can delete malware from Cortex XDR admin portal. 

Agent version 7.0.2

[SimonTan]

i have a similar question,

how does cortex deals with malware? does tech support have to take another antivirus to scan and clean the infected endpoint computer?

[KRisselada]

hello @PKhemarith perhaps I am not understanding your question or task requirement, but is this what is being asked?

"Retrive Files from an Endpoint"
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

I found the above in the Cortex XDR Pro Administrators Guide

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin.html

[dfalcon]

Hi there-  

Assuming you have quarantine malware enabled in your malware profile, no action is needed on your part.  If enabled, the agent will quarantine the file which means that it will encrypt the file and move it to a location that is inaccessible (left there in case it needs to be restored.)  The agent will delete the malware itself based on the quota settings specified in the agent profile.

Hope this helps.

[Balaraju]

Similar to above question is there a equivalent Palo Cortex tool as below from Microsoft ?

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-down...

Also if we do not have Quarantine = Yes then does the file stay infected or is it cleaned and left there ?

Also unable to understand the link between the question and ' quota settings specified in the agent profile' ? How is it related ?

Overall I see Cortex talks of always protection ( blocking ) and Quarantine , so what about cleaning a infected file ?