Cortex XDR folder exclusion

[DanieleGerola]

Hello,

does anyone know if it is possible to exclude an entire folder on a Windows machine from Cortex XDR scan in order to launch executable files without being blocked and having to add the file hash to the whitelist ?

[Ryan_Saulsbury]

You are able to define specific files and folders to exclude from examination and allow for execution. In the Policy you want this to apply to, it's under 'Malware Security Profile' > 'Files/Folders in Allow List'.

Here is the link to the documentation that explains the process:
https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cortex/cortex-xdr/cortex-xdr-pro-ad...

[dfalcon]

Hi @DanieleGerola-

@Ryan_Saulsbury is correct.  You can allow exclusions in the malware profile.  You may have to do this for each component -- portable executables, office docs, scans.  I've included a few screenshots where you would do this.  The screenshots also have examples of the formatting.

PE's and DLL

Scans

[EddieRowe]

My interpretation of the setting for exclusion for files in the Malware profile is only for dormant files when you use the weekly/monthly scan.  How do you exclude an entire folder completely?

[EddieRowe]

Ah, I see now... I overlooked the first picture!  Thanks!  I was not the original poster, but we appear to have a conflict with an encryption product.