Piloting XDR 7.3.1, policies seem more stringent- blocking previously allowed scripts and .exes
cancel
Showing results for 
Search instead for 
Did you mean: 

Piloting XDR 7.3.1, policies seem more stringent- blocking previously allowed scripts and .exes

L0 Member

We are in the process of updating our endpoint XDR agents from 7.2 to 7.3.1.  We are testing on a small pilot group and finding that scripts and executables that we previously ran are now being blocked.  Granted some these scripts are stopping and starting services and removing files.  We are concerned if we deploy it site-wide that we'll have many more blocks.  Some are being blocked on BTP and some via Child Process.  Have the policies changed, are they more stringent.  I've read the release notes and didn't get much information from them.  Thanks in advance!

1 ACCEPTED SOLUTION

Accepted Solutions

L1 Bithead

Hi @WORRELLR  just wondering what Content Version did you see the Child Process being blocked?  I know for a fact that I seen  a customer that just recently had a lot of processes on some build servers that were blocked as they were spawned from Java and it resulted in needing to put in a temp "fix" in the malware profile (in the malicious child process protection section) until later that day Cortex Operations released a "911" content update.  This occurred with Content Update 179-57885 and was "fixed" via content update 179-57935 the same day.  Support stated that a fix in Cortex XDR endpoint itself would occur likely in v7.4 (sometime June) 

 

I assume 7.3.2 is likely too far down the QA process timeline to put it there and delay that coming out  (<< just my guess.  I have no prior or inside info)

View solution in original post

3 REPLIES 3

L1 Bithead

Hi @WORRELLR  just wondering what Content Version did you see the Child Process being blocked?  I know for a fact that I seen  a customer that just recently had a lot of processes on some build servers that were blocked as they were spawned from Java and it resulted in needing to put in a temp "fix" in the malware profile (in the malicious child process protection section) until later that day Cortex Operations released a "911" content update.  This occurred with Content Update 179-57885 and was "fixed" via content update 179-57935 the same day.  Support stated that a fix in Cortex XDR endpoint itself would occur likely in v7.4 (sometime June) 

 

I assume 7.3.2 is likely too far down the QA process timeline to put it there and delay that coming out  (<< just my guess.  I have no prior or inside info)

View solution in original post

Thanks so much for the response, VERY helpful info! Our alerts were occurring 4/4 and the morning of 4/5. We actually had a few servers with the same issue that you had mentioned, had multiple blocks of a child process being spawned from JAVA. I see the latest content update (179-57935) hit the machines on the afternoon of 4/5 and we haven't seen the issue since then. We were just concerned moving forward. I feel more comfortable now, moving forward with 7.3.1 and later in June to 7.4. Thanks again.

excellent!  glad it was helpful

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!