Malware scan in cortex xdr

[Shashanksinha]

What is the difference between canceled scan, pending cancellation  and pending scan with respect to endpoint scaning ?

None: No scan initiated
Pending- Scan was initiated ,waiting for action to reach endpoint
In Progress- Scan is in progress
Success-Scan Completed
Pending Cancellation-Scan was aborted,waiting for action to reach endpoint
Canceled-Scan canceled
Error-Scan failed to run
System Uptime-Length of time since last device reboot.

Aborted scan-

Regards,

Shashank

[mavraham]

Hi @Shashanksinha,

Thank you for writing to Live Community.

I see you added the descriptions for some of the actions so assuming you're asking to also complete what does 'Aborted' means.

The difference between Aborted and Canceled statuses is simple. Canceled means the action was canceled before any endpoint started performing it, whereas Aborted means the action was canceled for all endpoints after at least one endpoint has started performing.

Pending means no endpoint has started to perform the action yet.

Pending Abort means no endpoint has started to perform the action yet.

Source:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Action-Cent...

Hope this helps!