exclusions vdi non-persistent

[tlmarques]

Hello, does anyone know if there is any document that tells us which folders and subfolders we should exclude from XDR when using Citrix and VMware Horizon with non-persistent VDI?

In Palo Alto's documentation, I don't see anything specific except for the app layers. However, both Citrix and VMware request the exclusion of many folders from the AV system. Can someone help?

[aspatil]

Hello Tiago,

Thank you for writing to Live community.

Could you please refer below article and discussion and let me know if that helps.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Corte...

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/non-persistent-vdi-shows-up-as-golden-im...

Please mark the response as "Accept as Solution" if it answers your query.

Regards.

[neelrohit · Accepted solution]

Hi @tlmarques ,

Thank you for writing to live community!

Besides what @aspatil mentioned, it really depends on Citrix variants that are available in your infrastructure. For example, there are some types of Citrix devices as below:

• Storefront

• Cloud Connector

• Receiver for Windows

• HVD Servers etc.

Based on the above and there could be many more, some whitelists that are generally made in Pre-execution modules of Cortex XDR Malware Profiles could be under the Citrix folders(eg. C:\ProgramData\Citrix\*,C:\Program Files (x86)\Citrix\*,C:\Program Files\Citrix\*)

However, we know that these are very broad whitelists and hence, you can ask your vendor to provide you with more granular whitelists which would definitely be a good use case to make under scanning and pre-execution allowlists.

Hope this helps. Please mark the response as "Accept as Solution" if it answers your query.

Regards

[tlmarques]

I've put the whitelist you share (eg. C:\ProgramData\Citrix\*,C:\Program Files (x86)\Citrix\*,C:\Program Files\Citrix\*) on "Portable Executable and DLL Examination"