Testing malware blocking and alerting in the xdr

[Daniel_Itenberg]

Hi all,

I'm trying to run checks on my mac, that has a cortex xdr agent, trying to see how the blocking & quarantine functions before setting the policy to all endpoint in my organization.

However, EICAR files, and the test file that palo alto provides here - https://docs.paloaltonetworks.com/wildfire/10-1/wildfire-admin/submit-files-for-wildfire-analysis/ve... - Don't generate any alerts nor any incidents.

I'd appreciate help in the matter  

[PeteJacobCF · Accepted solution]

hello, I have always used those and have not had an issue. I was using them to get all my alerting setup to ingest into my siem.

have tried to execute them? simply downloading them won't get caught unless you have the file scanning set up.