Does Cortex XDR provide protection for WSL running on Windows 10?

[PBurns]

Does anyone here know if Cortex XDR is installed on Windows 10 (20H2) if it would protect Windows Subsystem for Linix (WSL)? 

[eluis · Accepted solution]

Hi PBurns, 

CXDR could protect WSL as a process running in windows as it would protect VMware running in windows or any other software/process.

In case of virtual machines, and the like XCDR agent should be installed within the virtual machine/kubernetes .... this means that if you dont/cant install CXDR agent within the virtual machine or container whatever that happens inside the VM is not visible to CXDR agent. 
So CXDR protects the running processes for which it has visibility. 

[PBurns]

Thanks Eluis - I checked with our account team and they confirmed, XDR doesnt protect WSL today, installed on Windows and is not supported to be isntalled in WSL. There may have some capabities in the future in an upcoming release. 

[AGrijalba]

I guess this might depend on what version of WSL is the distribution running as.

WSL 1 is kind of windows native, meaning that all processes and files are just special windows processes and files. I think XDR could scan them.

WSL 2 is more similar to a VM, so all its processes and internal files are pretty much opaque from the outside (including the EDR). Cortex would only be able to scan their behaviour when they access Windows files (outside of the WSL partition), and perhaps analyze their outgoing network connections.