Cortex XDR Delete Malware

Reply
Highlighted
L0 Member

Cortex XDR Delete Malware

Hello 

 

i see alert malware in incident report . how i can delete malware from Cortex XDR admin portal. 

Agent version 7.0.2

Highlighted
L1 Bithead

i have a similar question,

how does cortex deals with malware? does tech support have to take another antivirus to scan and clean the infected endpoint computer?

Highlighted
L2 Linker

hello @PKhemarith perhaps I am not understanding your question or task requirement, but is this what is being asked?

 

"Retrive Files from an Endpoint"
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

 

I found the above in the Cortex XDR Pro Administrators Guide

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin.html

Highlighted
L4 Transporter

Hi there-  

 

Assuming you have quarantine malware enabled in your malware profile, no action is needed on your part.  If enabled, the agent will quarantine the file which means that it will encrypt the file and move it to a location that is inaccessible (left there in case it needs to be restored.)  The agent will delete the malware itself based on the quota settings specified in the agent profile.

 

Hope this helps.


David Falcon 
MDR Systems Engineer, Cortex
Palo AltoNetworks® 
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!