Cortex XDR Process Exclusions

[Namalw]

We are deploying Cortex XDR to Windows servers initially in Report only mode and seeing memory Utiliziation on some servers ranging 500 MB- 1.2 GB. Is this considered to be normal?

Advise we receive was that we don't need to exclude ceritan processes or file path similar to how Application vendors requested to be Whitelist.

Does anyone have experience deploying XDR on critical infrastructure and keen to know if you had to exclude processes (relalted to performance rather than noise) or XDR works out of the box without too much effort?

[aspatil]

Hello @Namalw ,

​Yes, observing memory utilization between 500 MB and 1.2 GB on Windows servers running Cortex XDR in "Report Only" mode is generally considered normal, especially during the initial deployment phase.

According to Palo Alto Networks, Cortex XDR's memory usage can range from 300 MB to 2 GB, depending on the system's workload. For most systems, a "normal" range is usually between 300 and 500 MB. However, for larger systems with high workloads, it's normal to exceed this range.

When deploying Cortex XDR on critical infrastructure, it's advisable to:​

• Avoid Whitelisting Specific Processes or Paths: Unlike traditional antivirus solutions, Cortex XDR doesn't typically require the exclusion of specific processes or file paths. The agent is designed to operate efficiently without manual exclusions.​

• Monitor Resource Usage: Keep an eye on memory and CPU utilization, especially during the initial deployment. If resource usage remains consistently high, consider adjusting the agent's configuration or consulting with Palo Alto Networks support.

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.