Cortex XDR on Windows blocks Ansible

[NicolasBriche]

Hello all,

I'm trying to switch to Ansible for my Windows application deployments (among other things), but Cortex XDR blocks everything Ansible tries to do with a Behavioral Threat response (it works via powershell.exe -EncodedCommand).

What are the best practices for using Ansible on an endpoint protected by Cortex XDR?

[nar · Accepted solution]

Hi @NicolasBriche 

Thanks for writing to LC!

Ideally, if the activity is legit, the agent should not block it.  It seems that the XDR agent may be seeing that as obfuscated activity hence blocking it.
In this case, its better we understand how you are running them and what BTP module is doing the detecting to have an appropriate exceptions created hence I suggest raising a ticket to TAC team to have the alert data investigated for most feasible exceptions.(TAC would suggest the exceptions for that specific use case).

Give it a like & mark as solution if this helped.

Best,

[NicolasBriche]

Thank you @nar , I'll see with our Palo liaison to open a ticket.

Regards,

N.