Cortex XDR Ransomware Protection: Aggressive mode & Resource Optimization

[H.Zaw245320]

Hello Community,

I have a question regarding Cortex XDR in Aggressive Mode. During my testing, I noticed that it significantly impacts my machine's performance, as the Cortex XDR agent continuously analyzes the behavior of benign software, such as browsers.

To optimize resource usage and performance, is it possible for Cortex XDR to analyze the behavior of benign software over an extended period (e.g., a month), establish a baseline, and then minimize or stop analyzing that software unless a deviation occurs?

Does Cortex XDR offer a policy or configuration to support this kind of adaptive analysis, or are there other recommendations to mitigate resource usage in Aggressive Mode?

Thank you for your insights!

#contex_xdr

#aggressive_mode

[nar · Accepted solution]

Hi @H.Zaw245320 

Thanks for your query on LC!

Generally,  we are not recommending to keep Aggressive Mode enabled always to avoid of this type of scenarios and also aggressive mode may make the decoy files distribute to many directries aggressively and be visible to users as well which may cause tampering attempts as well.

 Aggressive mode is part of ransomeware detection and this feature is designed for a scenarios where if user suspects that there is an infection they can enable it in such a scenario but should be disabled after.incase of customer is thinking that there is an infection they can enable it but should be disabled after.

Q- is it possible for Cortex XDR to analyze the behavior of benign software over an extended period (e.g., a month), establish a baseline, and then minimize or stop analyzing that software unless a deviation occurs?
A -  This may not be possible. The request is similar to our analytic engine over backend server but XDR Agent does not do this kind of processing on the agent bcz it requires so much data and time and processing power. Thats why we have analytics.

Q - Does Cortex XDR offer a policy or configuration to support this kind of adaptive analysis, or are there other recommendations to mitigate resource usage in Aggressive Mode?
A - We have Adaptive Policy (APEX) and Apex checks rules, modules etc built in with agent that monitors the overall resource consumptions in general but not specific/relevant to this feature. The option would be to disable aggressive mode and not to keep enabled in general as explained above.

Give it a like and mark as solution if this helped.

Best,