wf_vericts json file verdict values?

[JoeDay]

Exported wf_verdicts.db from an endpoint to validate local verdicts. Is there any reference for return codes and their meanings?

example:

"value": {
"verdict": 3,
"lruData": {
"lastUsed": "1613061210",
"index": "65945"

[gjenkins]

Hi @JoeDay,

It appears that you are trying to collect the local verdict for a file on an endpoint by extracting the wf_verdicts.db file. Currently, there's no public documentation available to share regarding the file. Would you like to explain that goal that you have in mind that would potentially utilize this information?

[gjenkins]

Hi,

I'd also like to point out that the local hash cache can be queried on Windows Endpoints using the following command which is more user-friendly than viewing the db file.

    cytool wf query [<hash>]

Note: The supervisor password is required to issue this command.

Source: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-0/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

[JoeDay · Accepted solution]

The verdicts handling was changed in version 7.2.

To check (verify) the verdict on the agent.

1. Export the entire wf_verdicts.db using cytool command: cytool persist export wf_verdicts.
2. Open the resulted JSON file using Text editor and search on the hash

Verdicts:
Invalid = 0,
Benign = 1,
Malware = 2,
Unknown = 3,
Grayware = 4,
NoConnection = 5