How I can Use host Firewall on Cortex XDR for blocked RDP conexion

[Rolando_Pena]

Hi everyone, I'm new user of cortex.

I need your help to use Host Firewall on Cortex for block RDP coneccions and permit only some groups,

I can block it using port, but I need allow conexion for IT group, i created two rules, one blocked RDP ports on both directions for everybody and the other allow traffic, and the target of second policy is just for IT groups. the second rule is at the top but. This not workings...

I need integrate other app like cloud identity engine or I can do it only with cortex?

thanks you for your help with this topics

Best!

Cortex XDR 

[jtalton]

Hello Rolando_Pena, 

Please confirm that you don't have any 'allow' rules that might be conflicting, and that the policy is correctly targeting the agent/endpoints that you're testing. I suggest assigning a different profile to the policy for the IT group that is allowed access, and the endpoints that you are testing, then confirm the agent has checked in to receive the policy configuration. 

You may enable "Report Matched Traffic" for troubleshooting:

Host Firewall for Windows • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documen...

If you found this answer helpful please select Accept as Solution.

Thank you