Malware Scan on XDR

[RamyashreeMada]

Hello,

How long does it take for endpoints to go to failed/canceled state from in progress state when malware scan ran on endpoints?

[mavraham]

Hi @RamyashreeMada,

Thank you for writing to Live Community. I'm not sure I fully understand your question.

Do you mean how long it will take the endpoint to go failed/cancelled in case the endpoint was disconnected or something interrupted the scan?

[RamyashreeMada]

Yes, That's what I mean.

[mavraham]

Hi @RamyashreeMada 

1. In the instance the connection is lost between the Endpoint and XDR cloud, but the scan had already started the scan should be completed and report the status back online if it happens within 24 hours.
2. In the instance the machine was shut down halfway through the scan the scan should indeed be cancelled/failed. This information should arrive to the XDR console in around 5-7 seven minutes, as the the Cortex XDR agent initiates communication with Cortex XDR every five minutes by sending a heartbeat to the server.

You can read more about Agent and Server initiated communication here.

If this helped, please click 'Accept as Solution'.

[TejasPatil]

After how long it should get cancelled or failed if system scan is in progress and system is also connected to console.

I mean what is the timeout period for Cortex XDR to cancel or fail the scan progress. I have seen few agents it keeps on scanning for more than 2-3 days .

[anlynch]

@TejasPatil,

If you are experiencing scanning that is taking 2-3 days to complete please submit this information in a case to our support center.  The amount of time it takes to perform a scan is dependant on several factors not limited to endpoint hardware.  In any case 2-3 days seems extremely excessive and support will be able to look into the issue deeper to ensure there are no underlying issues we're unaware of.

In reference to the question of timeout period, I don't' believe there is a timeout period for the scan.  Once the command has been sent, unless a disconnection is made the scan will commence and run until complete.

I hope you find this information helpful.

Have a great day!

[anlynch]

Hi @RamyashreeMada,

I just wanted to a supply a quick information update.  You asked earlier about how long it would take a scan to time out.  I was unaware of the time out, but can now confirm that the scan command should timeout after 24 hours.  This amount of time can be changed with a Support Exception, but would require having a ticket in with our support team.