Mac offline scan

[EricBjurstrom]

We have a mac that we suspect may be compromised.  We would like to run a scan with the device offline and not connected to our network.

How would we go about doing this?

[dbahuguna]

Hi @EricBjurstrom ,

Thank you for reaching out to Palo Alto Live Community.

In case your endpoint is compromised then you can first isolate the compromise endpoint. When you isolate an endpoint, you halt all network access on the endpoint except for traffic to Cortex XDR. This can prevent a compromised endpoint from communicating with other endpoints thereby reducing an attacker’s mobility on your network. please refer the document below for more information:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Isolate-an-...

After isolating the endpoint you can run the malware scan on a compromised endpoint, please refer the document below for more information about malware scan:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Scan-an...

Hope this helps!

Please mark the response as "Accept as Solution"