Response Action

[Shahwaz_Md]

There is an option Response Action under agent configuration, which means we can allow access to a certain application in case the endpoint is isolated.

Which application access should ideally be provided in it.

Thanks

[nsinghvirk · Accepted solution]

Hello @Shahwaz_Md 

Thanks for reaching out to Live Community.

When you isolate an endpoint, it will halt all network traffic except for cortex XDR traffic. "Response Actions" feature under Agent settings profile allow you to add specific applications to be allowed in case of Network Isolation.

Allowing a specific application depends on the customer environment and use cases. There is no recommendation from our side. 

For example, 

• (Windows) For VDI sessions, using the network isolation response action can disrupt communication with the VDI host management system thereby halting access to the VDI session. As a result, before using the response action you must add the VDI processes and corresponding IP addresses to your allow list.

• Some customer may want Windows Update service to continue to work even in isolation.
• Some may want to allow access to some other security tool e.g. DLP.

Please keep network access to bare minimum in case of Isolation to restrict attacker’s mobility on your network. Below is the link for your reference.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Respons...