Endpoint scans in endpoints with network shared folders

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Endpoint scans in endpoints with network shared folders

L0 Member

Cortex XDR 

By compliance, we need to set periodic endpoint scans. We have several endpoints which have network shared folders in common, and we wouldn't like to scan the same network shared folder several times at the same time. We would like to know how to solve that issue.
The ideal solution would be to have an option to scan the same network share folder just one time per scan in endpoints with the same profile.
We have thought to set the periodic scans in different hours (in endpoints with the same profile), but it wasn't possible either because we do not contemplate the option of creating a profile per endpoint.

3 REPLIES 3

L4 Transporter

Hi!

 

Thanks for reaching out to LIVEcommunity!

 

I'm looking into this and I'll get back with you shortly.

 

Have a great day!

L5 Sessionator

Hi @fmohedano , to meet compliance requirements, you can create a separate profile for one endpoint only, with network scan enabled. It is recommended to use a server as the endpoint to ensure that it is always on and runs the scan at the scheduled time. Workstations (laptops, desktops) might not be ideal as they're dependent on factors like the user being out of office for extended periods, unmounting the shared drive, network connectivity issues and other potential causes that might cause the scan to be skipped.

L2 Linker

Hello @fmohedano ,

 

This could be a problem on how policy inheritance works.

 

The inheritance works from top to bottom.

 

We can resolve your issue by doing different profiles based on their common identified and create exclusion on the Endpoint Scanning if they have a common network share folder.

 

Unfortunately, due to your requirement for them to be scanned on different hours and different situation -- only 1 malware profile can be inherited at once.

 

I hope you can open up a ticket or try to reach out to your SE for further assistance.

Let's have a seat and talk for a while.
  • 1787 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!