how remove softwares with XDR

[tlmarques]

Hello,
I've two questions.

First, I would like to know about your experience. How do you handle uninstalling software on specific devices that are not allowed and need to be removed via Cortex XDR  without the user noticing?

The second question is: Is it possible to block apps? For example, I don’t want users to install Wireshark. Can it be blocked

[jmazzeo]

Hi @tlmarques, thanks for reaching us using the Live Community.

Both use cases are not supported as an OOTB feature, as the XDR solutions aims to prevent malware and alert on suspicious behavior in processes (and many etcetera).

Anyway, it can be achieved with workarounds like running custom scripts for the first case, and creating custom BIOC rules to block the Wireshark executable by signer.

If this post answers your question, please mark it as the solution.

[tlmarques]

Hi @jmazzeo  thnks for your help.

In my company, we have issues with some users installing prohibited applications (e.g., Chrome, Wireshark). I want to either remove these apps or create a policy to block them every time they are launched.

Is it possible to create a BIOC rule and apply it to specific groups? Or would it be better to use an XQL query to exclude endpoints by name using the initiator field?

[tlmarques]

i've solved the exexcution with this:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000XgyMCAS

[jmazzeo · Accepted solution]

That's great, that is the approach I mentioned in my previous post, using BIOC rules.

You can apply the Restriction Profiles with the BIOC rules assigned to block to any different Endpoint Groups that you can configure from the console, or you can use your directory OUs or Groups (if applies) using the CIE integration.