XDR allwoing blocked files to run

[Aiman_Fathima]

Hello,

Even though we have added the file hash to the BLOCK LIST, XDR still alllows the process to run. Does someone know  the reason for why this is occuring. 

[jtalton]

Hello Aiman_Fathima, 

Blocking files on endpoints is also enforced by the endpoint malware profile. Please ensure that your Malware Security Profile is set to block mode.

In Action Center, on the Block list page, you may select Override Report mode to allow the agent to block hashes even if the Malware Profile is set to Report.

• Please check Action Center to confirm the file hash is in the Block List: Incident Response >Response> Action Center > Block List
• Select Override Report mode to allow the agent to block hashes even if the Malware Profile is set to Report.

If all is configured, please open a support case for troubleshooting. 

Reference

Endpoint Security Profiles (paloaltonetworks.com)

Add a New Malware Security Profile (paloaltonetworks.com)

Thanks

[Aiman_Fathima]

Thank you

[Cyber1985]

Was this your solution? From our expierience you should watch out if this hash/File is not in the Quarantäne. In some of our cases the computer needs a restart to work. 

It would be nice to know, how we can check, if this blocked hash is updaten to the Client. 

BR 

Rob