How to whitelist folder

[JoaoMachado]

Hello,

There is a user who is learning C/C++ and for the course, he has to do several small scripts.

Cortex XDR is blocking all created scripts, marking them as malicious.

These are written in VSCode, but because they are compiled and run as .exe, I can't just whitelist VSCode.

So I wanted to whitelist a folder or workspace, but I'm not finding how. I thought it would be under "EXCEPTIONS CONFIGURATION > Disable Prevention Rules" but my test didn't work.

Thank you for all the help.

[dbahuguna · Accepted solution]

Hi @JoaoMachado ,

Thank you for reaching out to Palo Alto Live Community.

You can try to define specific files and folders to exclude from examination and allow for execution. In the Policy you want this to apply to, it's under 'Malware Security Profile' > 'Files/Folders in Allow List'.

Here is the link to the documentation that explains the process:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-M...

You may have to do this for each component - portable executables, office docs, scans.  I've included a few screenshots where you would do this.  The screenshots also have examples of the formatting.

PE's and DLL

Scans

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

[eumbach]

I would not whitelist a folder. This allows any application to be run from that directory. Instead, I would look into Code Signing.