XDR command line scan

[PaulDownes]

Hi All, I've been looking at the functionality of the cytool command line and cannot find a way to scan a particular file, which is available if you right click the file in Windows. Can anyone tell me if the ability to scan an individual file, or folder available from command line in XDR client?

Thanks, Paul

[kiwi]

Hi @PaulDownes ,

In order to get better traction for this, I have moved your query to the Cortex area.
I would recommend that you visit this area to see your discussion and others on Cortex.

Cheers,

-Kiwi.

[fmoixsante]

Hi @PaulDownes 

The scan malware option is not part of the cytool commands.

There are some alternatives

1. cytool fileinfo c:\path\to\app1.exe - process needs to be known to WF/LA
   1. this will give you information about app1.exe. you want to look for the File SHA256 value
2. cytool wf query app1_sha256_value
   1. If you do not get a result, it means that WF/LA do not know it. At this point, you first need to upload the file to WF. You can do that by scanning the file using the mouse
   2. you could use cytool imageprep. this will look at all the volumes are upload to WF those that are unknown. This operation could take quite some time, at least the first time executed. Later imageprep scans, would take less time as only those new unknown executables will be uploaded to WF.

[PeteJacobCF]

looks like looking at the official docs you can just start a scan:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/5-0/cortex-xdr-agent-admin/traps-agent-for-windo...

I would however confirm with the tac

[PaulDownes]

Thanks folks, all very helpful. I'm going to accept Fmoixsante's suggestion about the imageprep scan as the accepted solution, might be able to run with that. If there was something flagged on the client machine to say the scan marked the file safe / unsafe, I could possibly use that to trigger a subsequent action to admins also. I appreciate the insights from you all, thanks again.