Custom Scan Cortex XDR

[J.MorenoCiudad]

Hello,

I have a few questions regarding the Custom Scan functionality on Windows endpoints, and I have not been able to find the answers in the available documentation.

First, I understand that Custom Scan has a limit of 100 items per scan. However, I have noticed some unexpected behavior when running scans:

• When I select only one file, the elapsed time displayed is 1 second.

• When I select two or more files, the elapsed time displayed is always 0 seconds.

I would like to know whether this is expected behavior or if there is a known issue with this functionality. 

Secondly, I would like to understand what exactly Custom Scan does. Does it perform a signature-based scan similar to traditional antivirus solutions, or does it use other detection mechanisms, such as local malware analysis or WildFire?

Finally, I would like to know which file types are not supported by Custom Scan. The documentation states the following:

"If you scan an unsupported file type, the Cortex XDR agent console will not show a notification for it, and the file will be considered non-malicious."

Could you please provide a list of unsupported file types or explain how to determine whether a particular file type is supported?

Thank you very much for your help. I look forward to your response.

Best regards,

[susekar]

Hello @J.MorenoCiudad ,

Greetings for the day,

1. Custom Scan Elapsed Time (0 vs. 1 Second)

• The exact reason for the difference is not documented; it may relate to scan timing or cached verdicts.

• Check trapsd.log under C:\ProgramData\Cyvera\Logs\ to verify scan activity and completion timestamps.

• If the behavior appears incorrect, collect a Tech Support File (TSF) for further investigation.
  
  

2. Detection Mechanisms Used

• WildFire: Checks local verdicts and cloud threat intelligence.

• Local Analysis: Uses machine learning to analyze unknown files, if enabled in the Malware Security Profile.

• Alerts: Malicious files appear in the Cortex XDR management console as Detected (Scanned).
  
  

3. Supported and Unsupported File Types

• Supported: PE executables (.exe, .scr), DLLs (.dll, .ocx), and supported Microsoft Office files containing macros.

• Unsupported: PowerShell scripts during on-demand scans, archives (.zip, .iso), virtual disk containers, and other unsupported file formats.

• Unsupported files generally do not generate scan alerts and rely on other applicable runtime protections.
  
  Note: Custom Scan uses verdict-based and machine-learning analysis, supports specific file types, and may display very short scan durations due to immediate verdict evaluation.
  
  

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar