wf_vericts json file verdict values?
cancel
Showing results for 
Search instead for 
Did you mean: 

wf_vericts json file verdict values?

L0 Member

Exported wf_verdicts.db from an endpoint to validate local verdicts. Is there any reference for return codes and their meanings?

 

example:

"value": {
"verdict": 3,
"lruData": {
"lastUsed": "1613061210",
"index": "65945"

1 ACCEPTED SOLUTION

Accepted Solutions

L0 Member

The verdicts handling was changed in version 7.2.

 

To check (verify) the verdict on the agent.

  1. Export the entire wf_verdicts.db using cytool command: cytool persist export wf_verdicts.
  2. Open the resulted JSON file using Text editor and search on the hash

Verdicts:
Invalid = 0,
Benign = 1,
Malware = 2,
Unknown = 3,
Grayware = 4,
NoConnection = 5

View solution in original post

3 REPLIES 3

L4 Transporter

Hi @JoeDay,

 

It appears that you are trying to collect the local verdict for a file on an endpoint by extracting the wf_verdicts.db file. Currently, there's no public documentation available to share regarding the file. Would you like to explain that goal that you have in mind that would potentially utilize this information?

--gjenkins

Hi,

 

I'd also like to point out that the local hash cache can be queried on Windows Endpoints using the following command which is more user-friendly than viewing the db file.

 

    cytool wf query [<hash>]

 

Note: The supervisor password is required to issue this command.

 

Source: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-0/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

--gjenkins

L0 Member

The verdicts handling was changed in version 7.2.

 

To check (verify) the verdict on the agent.

  1. Export the entire wf_verdicts.db using cytool command: cytool persist export wf_verdicts.
  2. Open the resulted JSON file using Text editor and search on the hash

Verdicts:
Invalid = 0,
Benign = 1,
Malware = 2,
Unknown = 3,
Grayware = 4,
NoConnection = 5

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!