Whitelist IP from XDR anlysis

[Kevin_Robers]

Hello,

We would ike to know if it is possible to create a list of IP's that will not be analysed by any of the XDR protection modules.We have a vulnerability scanning tool that uses all sorts of scripts to perform its tasks, At the moment, most of these scripts are blocked by Cortex because they look suspicious, which is true but not wanted in this situation.

We would like to create some sort of whitelist that prevents XDR from analyzing / inspecting / blocking traffic from these IP's. Is such a thing possible?

[WSeldenIII]

Hi @Kevin_Robers, We want to maintain security of environment while reducing operational impact. I believe obtaining some additional context on the alert criteria / scope will assist in determining the most effective path forward.  The following information will help to guide you on determining next steps: 

• Have you completed vulnerability scans in your environment in the past, or this the first occurrence? If you have complete vulnerability scans without any operational impact, then this may be an opportunity to enhance the alert efficacy with content updates on your Cortex XDR agents. You will need to retrieve the endpoint support file from an endpoint in scope, and raise a support ticket for additional analysis.
• Do the alerts in questions have a "detection" alert action? If so, then there should not be any change in the behavior of the file / process execution on the endpoint.  
• Do the alerts in question have a “prevention” alert action?  If so, then you may consider adding the process / file path to an allow list / alert exception to continue operations. 
• Similar to the first bullet, if the behavior in the alert originated from your vulnerability scanner and it is not a threat, then you can coordinate with support on the next steps (E.g. content update).