Help regarding disk encryption visibility of cortex xdr

[AakashShinde]

Could you please provide any documentation regarding Disk encryption in Cortex XDR? I would like to know if we need to manually enable BitLocker or if it can be enabled automatically by pushing the host disk encryption policy to all endpoints. Also, where are the BitLocker keys stored? Does Cortex XDR have BitLocker keys for every endpoint? 

Cortex XDR 

[aspatil]

Hello @AakashShinde ,

Thanks for reaching out on LiveCommunity!

XDR doesn't execute the disk encryption it leverages the operating system tools to enforce compliance. For Windows Bitlocker is used and for macOS it is file vault. For Windows the bitlocker keys need to be stored in Active Directory and Group Policy should be used to control the policies.

The Cortex XDR Disk Encryption profile for Mac can encrypt the endpoint disk, however, it cannot decrypt it. After you disable the Cortex XDR policy rule on the endpoint, you can decrypt the endpoint manually.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Disk-Encryp...

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.