Long Malware Scan time, normal?

[SeanDeHarris]

hello all experts, 

I have encountered a long scanning time,  i launched a malware scan from console to isolated endpoint, the job was created at 15:30 and finished by 05:30 by next day.

Guessing when the job was created, either the agent was disconnected/fail to sync/the server failed (through websocket) to connect to agent/scan was finished early but failed to update the status to the server.

In order to prove my assumption, gone through the Management Audit logs or Agent audit log cannot find much info.

Is it possbile to look for 

1) when was agent (disconnected from the server)

2) failure logs when server cannot reach the agent

3) the scanning time of a malware scan

Thanks,

[jmazzeo]

Hi @SeanDeHarris thanks for reaching us using the Live Community.

The agent audit logs can be reached in the console at Settings - Agent Audit Logs. There you will be able to track and monitor some agent activity detailed in this document. As is mentioned there in the doc, you can also forward those events.

As you mention, when the scan action is created in the console it can take some time to reach the endpoint and start it due to any of the causes you described in the post. The scan action status can be followed in the Action Center at Incident Response - Response - Action Center.

If you want to check the conection details for the agent, the failed connections to the console, when the scan starts, pauses and finishes with date details, you need to take a look at the local agent logs in the trapsd.log file located in:

Windows: %ProgramData%\Cyvera\Logs

Mac: /Library/Logs/PaloAltoNetworks/Cortex XDR/

Linux: /var/log/traps/

You can also generate a Support File from the console that contains all the endpoint logs required for analysis.

The logs are kept for the last 30 days in the endpoints folders.

I hope this can help you.

If this post answers your question, please mark it as the solution.