Cortex XDR - Detected (Scanned) alert for malware

[Joe_Botelho]

Hello, 

Please excuse me if these are very basic questions. I have been trying to find a definitive, written answer and have been unable to, so far. 

If

1. Portable Executable and DLL Examination is set to the default of 'block' in an applied Cortex XDR policy,

2. a scan is run on an endpoint using that policy

and

3. a malicious executable is found on that device, why does the alert show as "Detected (Scanned)" for the file? 

Is the endpoint protected from that malicious executable? 

Based on the default setting, would that file be blocked if it attempted to execute and since it is dormant, it has only been identified during the scan but no action is necessary (other than an alert)? 

Thank you for any help with this. 

[OrkanAlibayli]

Hello ,

By default XDR don`t do anything malicious file ( if this file is not running). But you can quarantine this file ==> Endpoints/Policy Management/Profiles/Malware/Portable Executable and DLL Examination/QUARANTINE MALICIOUS EXECUTABLES

[jcandelaria · Accepted solution]

a malicious executable is found on that device, why does the alert show as "Detected (Scanned)" for the file? 

Detected (Scanned) means we detected the file as malware during the scan.

Is the endpoint protected from that malicious executable?

Yes, because the default policy is in block mode

Based on the default setting, would that file be blocked if it attempted to execute and since it is dormant, it has only been identified during the scan but no action is necessary (other than an alert)?

yes it will be blocked, there is a setting to change quarantine malicious executable where you can change it to Quarantine Wildfire Malware verdict so that way file that is scanned and if it has WF malware verdict then it will be quarantined. Step 3 --> option 2 from the link below

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-...

[Joe_Botelho]

Thank you for the responses. 

As a follow up, if a file is on the blocklist already but is given a WildFire verdict and "Quarantine WildFire malware verdict" has been enabled in the applied malware profile, why isn't the file actually quarantined? Is it due to it already being on the blocklist? 

[mabutbul · Accepted solution]

Hey @Joe_Botelho 

The file should be moved to quarantine if the "Quarantine WildFire malware verdict" is flagged in the profile regardless of the fact it is in the block list.

In case it doesn't please do the following:

- validate the setting is enabled in the profile

- validate the profile the agent is getting

- open a support ticket to track the issue if none of the above works.

thanks