Preventing CrowdStrike disaster in Cortex XDR Pro

[RFeyertag]

Hello dear community!

what could we or PA setup in PA Cortex XDR to prevent us from such a disaster which happened to CrowdStrike?

Are there any settings or recommendations which can be shared? 

BR

Rob

[tlmarques]

Hi @RFeyertag ,

What I recommend, and what I have implemented in my XDR, is the agents only perform auto-updates after 7 days (on settings you can see agent upgrade).
If there is an urgent update, I go to the tenant and force all devices to upgrade.

This way, the risk of problematic software is reduced.

[Rocky-25]

@tlmarques In a case like CrowdStrike's last week, this approach doesn't solve the issue. The faulty update was caused by a content update and not an agent update. However, you thankfully have the option with Cortex XDR to delay content updates through agent settings profile: Add a New Agent Settings Profile • Cortex XDR Prevent Administrator Guide • Reader • Palo Alto Netwo...

We deploy content updates on 10% of the endpoints immediately and delay the remaining 90% for 2 days to make sure our business is not paralyzed by a faulty update.

[tlmarques]

Hi @Rocky-25 , thanks for correction.
I've say agent only, but our rule is apply for both options (agent and content).