Cortex XDR Delete Malware

[PKhemarith]

Hello 

i see alert malware in incident report . how i can delete malware from Cortex XDR admin portal. 

Agent version 7.0.2

[SimonTan]

my solution is to get another antivirus to remove the source file (virus).

[bbarmanroy]

Hi @Balaraju, quarantined files will need to be unquarantined manually.

The process of "cleaning a file" is very subjective. The file could be malicious by nature, or can be affected by a malicious process, among others. An example of that would be a ransomware attack. While the ransomware file is malicious and needs to be removed from the host, files affected by the ransomware are encrypted on disk and needs a decryption key for "restoring". The process of "cleaning" ensures a complete disk-wipe, and additional investigative and forensic activities to understand the limit of attack, exposure and compromise while figuring out the remediation plan including restoring from backups and enforcing stricter security controls to prevent such activities. This requires human intervention and analysis.

[bbarmanroy]

Hi @SimonTan how about leveraging the existing capabilities of XDR to search and delete a file? Take a look at https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

If you don't have Host Insights, you can write your own custom Python script for search files by names or hashes and delete them. See it here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...