Details regarding %PROGRAMDATA%\Cyvera\ folders

[MoKhaled]

Interesting query I got was from a client running Microsoft defender alongside Cortex XDR. I already understand from another post:

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-along-side-ms-defender-for-en...

Not to have both active at the same time, either has to be either passive or disabled.

His current situation is that Defender is flagging one of the recent files in programdata/cyvera/prevention as spyware. As he asked what exactly this folder is, I realized that I am not sure what each folder inside the Cyvera section usage or function.

Looking through administration guide was a futile effort as there was no details for folders.

Can someone explain to me what each folder use is or at least for programdata/cyvera/prevention?

[aspatil]

Hello @MoKhaled ,

This is where Prevention Data is stored locally, the file that you can request from the UI using (Retrieve Alert Data), aka the Prevention Dump.

Recent Files are a component of this prevention dump, often containing files that were open at the time of the event, or libraries loaded into an offending/protected process and those sort of files.

You should exclude c:\programdata\Cyvera\* from all protection modules in Defender or it's going to cause issues one way or another.

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.