System Lockdown with XDR

[Jaitapkar]

Hi Folks,

With Cortex XDR can we use feature like System lockdown, more likely say that execute only allowed application and rest all blocked.

It is possible?

Cortex XDR 

Regards,

Mansoor

[bbarmanroy]

Hi @Jaitapkar while this might not meet your needs, you can isolate an endpoint and prevent lateral movement and restrict all network activity. 

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

[MarvinC]

Hi Jaitapkar, 

Are you referring to certain feature like Sophos Server Lockdown where you cannot run/install any unauthorized or unrecognized application unless the lockdown was removed from the server and have the list updated. 

As of now, there is no similar feature here in Cortex XDR. There is a restriction policy but it does similarly fit to the server lockdown function. 

I highly suggest to contact the SE for a feature request regarding this and I'd also be happy seeing this feature in Cortex XDR.