URL & Application level blocking possibilities in Cortex XDR.

[Aneesh]

Hi All,

Hope you all are doing good.

Can anyone help me to understand the possibilities of url and application-level blocking in XDR?

Following are my scenarios,

1. Blocking of URLs in XDR. 

2. Blocking of execution/installation of specific applications in XDR.

3. Blocking of applications running without installation.(eg. anydesk application running directly by double clicking the .exe file).

Cortex XDR 

Support will be very much appreciated.

Aneesh

[aspatil]

Hello @Aneesh ,

Thanks for reaching out on LiveCommunity!

For URL blocking you can take the help of EDL blocking:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-Exte...

For point 2 and three you can configure a custom prevention rule for a BIOC Process event, apply it to the Restrictions profile with an action mode set to Block.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BI...

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.