Cortex XDR - Detected (Scanned) alert for malware

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Cortex XDR - Detected (Scanned) alert for malware

L1 Bithead

Hello, 

Please excuse me if these are very basic questions. I have been trying to find a definitive, written answer and have been unable to, so far. 

 

If

1. Portable Executable and DLL Examination is set to the default of 'block' in an applied Cortex XDR policy,

2. a scan is run on an endpoint using that policy

and

3. a malicious executable is found on that device, why does the alert show as "Detected (Scanned)" for the file? 

 

Is the endpoint protected from that malicious executable? 

 

Based on the default setting, would that file be blocked if it attempted to execute and since it is dormant, it has only been identified during the scan but no action is necessary (other than an alert)? 

 

Thank you for any help with this. 

 

 

 
2 accepted solutions

Accepted Solutions

L3 Networker

a malicious executable is found on that device, why does the alert show as "Detected (Scanned)" for the file? 

Detected (Scanned) means we detected the file as malware during the scan.

 

Is the endpoint protected from that malicious executable?

Yes, because the default policy is in block mode

 

Based on the default setting, would that file be blocked if it attempted to execute and since it is dormant, it has only been identified during the scan but no action is necessary (other than an alert)?

yes it will be blocked, there is a setting to change quarantine malicious executable where you can change it to Quarantine Wildfire Malware verdict so that way file that is scanned and if it has WF malware verdict then it will be quarantined. Step 3 --> option 2 from the link below

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-...

 

View solution in original post

Hey @Joe_Botelho 

 

The file should be moved to quarantine if the "Quarantine WildFire malware verdict" is flagged in the profile regardless of the fact it is in the block list.

In case it doesn't please do the following:

- validate the setting is enabled in the profile

- validate the profile the agent is getting

- open a support ticket to track the issue if none of the above works.

 

thanks

View solution in original post

4 REPLIES 4

L2 Linker

Hello ,

 

By default XDR don`t do anything malicious file ( if this file is not running). But you can quarantine this file ==> Endpoints/Policy Management/Profiles/Malware/Portable Executable and DLL Examination/QUARANTINE MALICIOUS EXECUTABLES

L3 Networker

a malicious executable is found on that device, why does the alert show as "Detected (Scanned)" for the file? 

Detected (Scanned) means we detected the file as malware during the scan.

 

Is the endpoint protected from that malicious executable?

Yes, because the default policy is in block mode

 

Based on the default setting, would that file be blocked if it attempted to execute and since it is dormant, it has only been identified during the scan but no action is necessary (other than an alert)?

yes it will be blocked, there is a setting to change quarantine malicious executable where you can change it to Quarantine Wildfire Malware verdict so that way file that is scanned and if it has WF malware verdict then it will be quarantined. Step 3 --> option 2 from the link below

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-...

 

L1 Bithead

Thank you for the responses. 

 

As a follow up, if a file is on the blocklist already but is given a WildFire verdict and "Quarantine WildFire malware verdict" has been enabled in the applied malware profile, why isn't the file actually quarantined? Is it due to it already being on the blocklist? 

 

 

Hey @Joe_Botelho 

 

The file should be moved to quarantine if the "Quarantine WildFire malware verdict" is flagged in the profile regardless of the fact it is in the block list.

In case it doesn't please do the following:

- validate the setting is enabled in the profile

- validate the profile the agent is getting

- open a support ticket to track the issue if none of the above works.

 

thanks

  • 2 accepted solutions
  • 9341 Views
  • 4 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!