Policies at risk - how to accept these?

[RFeyertag]

Hello dear all!

How can I accept the risk of policies, which would be needed somewhere in the future?

I do not want to delete them. Just accept the risk. 

BR

Rob

[nsinghvirk]

Hello @RFeyertag 

Thanks for reaching out on Live Community!

Risky prevention policy notifications are in the form of warning badges and labels. XDR identifies risky prevention policies based on Palo Alto Networks best-practice policy settings.

Currently these are mere notifications and cannot be used for risk acceptance. You can use them in order to fine tune your prevention policies.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[tlmarques · Accepted solution]

Hi @RFeyertag 

I would like to inform you that since the October 2023 XDR release, Palo Alto have introduced a new feature that identifies those profiles which has the modules to be either in "Report" or "Disabled" mode. It is kind of a warning or a notification stating that the endpoints which are reporting to these profiles might be at risk as their modules are in report or disabled mode.

Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Release-Notes/October-2023

Ignore this notification if the mode of action of the listed policies is set as you intend.
At present, there is no method to eliminate the notification.

Please mark the response as "Accept as Solution" if it answers/help your question.

[tlmarques · Accepted solution]

Please mark the response as "Accept as Solution" if it answers/help your question.

[tlmarques · Accepted solution]

Please mark the response as "Accept as Solution" if it answers/help your question.