Cortex XDR - False positive - Cloud2Model Manager 1.005

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex XDR - False positive - Cloud2Model Manager 1.005

L1 Bithead


Some of the users of Cloud2Model are resporting that Cortex XDR is blocking the installer "Cloud2Model Manager 1.005 x64 setup.exe" with this Cortex XDR code: c0400055. This is a legitimate application and the installer is signed with a EV code certificate. You can check the instaler here:

Please check this issue ASAP. I am very interested in knowing the reasons that trigger to block the file.

Many thanks in advance.


L4 Transporter

Hi @eproca ,

From what I can tell, you may be encountering an issue where Local Analysis has determined that your sanctioned software is malware and is blocking it due to policy configuration. To override the local analysis verdict and permit this software to run immediately, you can apply the hash for the file in the Allow List for Cortex XDR using the following instructions.


To understand why your file was blocked, I would recommend opening the Hash View to see the information collected by Cortex XDR in terms of the threat intelligence and the incidents related to the hash. You can access the Hash View by clicking the circle icon (gjenkins_0-1615907288514.png) on the top-right of your screen, pasting the hash into the search bar, and clicking, "Open Hash View of..." There you will find more information regarding the hash and the verdict provided.

Please let me know how this goes when you have the opportunity.


hi @gjenkins ,

Thanks for your feedback. I am the application developer but not the Cortex XDR user. I dont have any direct access to the Action Center of Cortex XDR or possibility to check the Hash View. Anyway I will pass the information to the actual Cortex XDR users.

Is there any way to "white list" a file globally for Cortex XDR? I mean without having to be an actual user of Cortex XDR. Some antivirus have proccedures and protocols for this kind of situations.

Many thanks in advance for your support

Hi @eproca,


As you mention, I would get in touch with your XDR admin and refer him to the following links.


    • Here you can add applications path and name to the Allow list directly in the Malware profile. By doing this, you can use the wildcard (*) and future-proof the tuning
      • c:\folder_a\folder_b\folder_v1.2.3\application_v1.2.3.exe could turn to c:\folder_a\folder_b\folder_v*.*.*\application_v*.*.*.exe
      • Something like the above will make sure that current and future same application versions are allowed by the XDR agent
      • NOTE, adding anything to the allow list in the Malware profile is like poking a tiny whole in the security of the XDR agent, so please be as precise as possible and do not overuse the wildcard (*)

You also mentioned that the application you want to allow is also digitally signed. You can also add the signature to the Allow List Signer in the Malware Profile,


Passing the information along to the Cortex XDR administrators for your instance is the best next step in this case. Thank you for forwarding it. Once they have applied the hash to the allow list, it will apply to all endpoints within your environment.


You can add to the allow list for your environment globally by using the instructions above or watching the following video.


XDR Pro + Prevent

Managed File Execution


As for a true global verdict via Wildfire submission, the best way to submit is by executing the file on a device with Cortex XDR. Once executed, Wildfire will receive a copy submitted from that endpoint and provide its verdict within 24 hours. That verdict is distributed globally across all tenants.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!