URL & Application level blocking possibilities in Cortex XDR.

[Aneesh]

Hi All,

Hope you all are doing good.

Can anyone help me to understand the possibilities of url and application-level blocking in XDR?

Following are my scenarios,

1. Blocking of URLs in XDR. 

2. Blocking of execution/installation of specific applications in XDR.

3. Blocking of applications running without installation.(eg. anydesk application running directly by double clicking the .exe file).

Cortex XDR 

Support will be very much appreciated.

Aneesh

[aspatil]

Hello @Aneesh ,

Thanks for reaching out on LiveCommunity!

For URL blocking you can take the help of EDL blocking:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-Exte...

For point 2 and three you can configure a custom prevention rule for a BIOC Process event, apply it to the Restrictions profile with an action mode set to Block.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BI...

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[ycgmis]

This is just pointing a firewall to an EDL that's managed in the cortex tenant. What if the user takes their laptop home and is no longer behind the corporate firewall? Is there a method of blocking access to a URL by cortex XDR itself?

[maximk]

Indeed, EDL can't be helpful without firewall.  All the mentioned restrictions can be achieved using BIOC rules assigned to restriction profile. 

Example of BIOC for blocking URL:

dataset = xdr_data

| filter event_type = ENUM.NETWORK and action_external_hostname in ("facebook.com", "instagram.com", "linkedin.com", "x.com")