New to Cortex - Whitelisting files/paths, are they needed

[jeperjes]

I am looking for definitive answers on whether or not exe files should be whitelisted and where they should be whitelisted within Cortex?

[jeperjes]

the files to be excluded are known windows files. 

[Cyber1985]

Maybe palo alto could bringt out a short Video for white and blacklisting paths/files? 

BR

Rob

[Cyber1985]

I would also be interested, if this Feature from Cortex xdr pro is comparable to applocker. 

BR

Rob

[neelrohit]

@jeperjes @Cyber1985 ,

It likely depends on the used cases on what should be whitelisted. Definitely the easiest, quickest and the best whitelisted always is SH256 allow list, which is granular in itself. However, as iterated, when it comes to whitelisting executables, it would depend upon the business used case and alerts around it. 

Windows executables are microsoft signed application executables and because Microsoft is a highly trusted signer, Cortex XDR does not detect and examine it in the pre-exection stages(like Wildfire malware, Local Analysis). 

In the post execution stages, everything is examined as it leverages behavioral execution monitoring for script based, fileless attacks and exploitation events as well. 

We also have a process exception which has the capability to disable select protection modules for Cortex XDR depending upon the choices and used cases. 

Please be apprised all of the above, will be specific to targets and profiles and should be implemented very carefully

[jeperjes]

what is the right way to enter *.exe files into whitelists, or find the
hash of a file and add that to the whitelist? What is the right way to
handle files to whitelist to avoid malicious files attacking a server? I
am not familiar with the cortex and how they handle malwares.