Hi @ndrmndz
Adaptive Policy is established to address high CPU/memory detected. When Adaptive Policy is first executed by the endpoint, it will go into a partially protected state as presented in the operational status data you provided. This will initially disable BTP and Event Collection (EC) functionality.
On the endpoint, cytool can be utilized to examine/manage the Adaptive Policy. From C:\Program Files\Palo Alto Networks\Traps, enter the command “cytool adaptive_policy query” into your command line to view the status of your Adaptive Policy state (assuming this is on Windows, commands may slightly differ depending on OS). It should look similar to the following in the case of your partially protected operational status with BTP and EC disabled.
More information regarding managing Adaptive Policy can be found when looking at the manual for the same command as well, with the “/?” option instead of “query”.
Setting the Adaptive Policy interval to zero (>cytool adaptive_policy interval 0) will disable Adaptive Policy from running from the next cycle and will disable the Adaptive Policy exception. Adaptive Policy recalculations can also be done to trigger a recalculation of the existing Adaptive Policy. The following remediation selections will likely vary in success depending on your existing configuration.
The available selections from this menu can be used to remediate the issue if high resource utilization is not persistent. If you are experiencing limited protection frequently, we highly recommend contacting technical assistance to help address this issue at support.paloaltonetworks.com.
Adaptive Policy was also one of the primary topics discussed in the Cortex XDR webinar for the month of September. More information can be found on the Live Community webinar page:
