Urgent Assistance Required – Cortex XDR Performance

[tlmarques]

Hi everyone,

I urgently need your help with a Cortex XDR  configuration issue.

We need to completely exclude specific directories from Cortex XDR activity, ensuring that the agent does not perform any scanning, analysis, injection, or other operations within those directories.

Initially, we suspected that the issue was related to Exploit Protection. We configured the relevant Exploit exceptions, and we can no longer see DLL injection in the affected processes when checking them in Process Explorer.

However, when using Process Monitor (ProcMon), we can still see file activity from cyserver.exe against files within the excluded directories.

So far, we have configured exclusions for:

• Portable Executable and DLL Examination

• Endpoint Scanning

We have also created Disable Prevention Rules covering all available modules for the affected directories, but the issue persists.

According to our software partner, no Cortex XDR activity should be visible within these directories in ProcMon, as required by their R&D team.

How can we completely exclude these directories from Cortex XDR activity? Are there any additional settings or specific exceptions we should configure to achieve this?

This is urgent, as the issue is affecting the performance and reliability of a clinical application.

Any help or guidance would be greatly appreciated.

Thank you!

[susekar · Accepted solution]

Hello @tlmarques ,

Greetings for the day.

Seeing cyserver.exe activity in ProcMon can be expected even after configuring path exclusions and disabling prevention rules, because Event Collection (ECL/EDR) operates independently of prevention and scanning modules.

Recommended steps:

• Configure exclusions for both Endpoint Scanning and Portable Executable/DLL Examination.

• Review the Agent Settings profile for applicable Event Collection exclusions.

• Temporarily disable Event Collection using cytool event_collection disable to confirm whether it causes the activity, then re-enable it after testing.

• If the issue persists, collect a debug TSF and ProcMon (.PML) capture and escalate to Palo Alto Networks Support for a targeted Support Exception (SUEX).

Note: Complete elimination of ProcMon activity may not be possible while the agent is actively monitoring the endpoint.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[tlmarques]

Even after applying the recommended configurations, disable event_collection and disabling Agent Pro mode etc, we continue to observe these events.
Personally, I believe this is expected behavior, as these activities are inherent to the way an EDR/XDR solution operates.

However, some companies still consider these file system accesses intrusive and, as a result, are reluctant to provide support when they occur.

Thank you very much for sharing this information.