XDR on-write exclusions

[tlmarques]

Hi,

Is it possible to exclude certain executables and their hashes from on-write protection on Cortex XDR ??

[jmazzeo · Accepted solution]

Hi @tlmarques, thanks for reaching us using the Live Community.

There is no possibility to create an exclusion for the On-Write protection itself. This module detects when a new file is writed on disk, and then starts the usual file analysis flow:

Then you have two options:

• If a file is blocked and you need to allow it, check which module is blocking it and then create the exception for that module under Settings - Exceptions Configuration.
• Create an Administrative Hash exception, going to Settings - Exceptions Configuration - Disable Prevention Rules, and adding a new rule with the file hash and selecting "Hash Control" as the module.

Please let me know how it goes.

If this post answers your question, please mark it as the solution.

[tlmarques]

@jmazzeo how i can check which module is blocking ??

[P.Ghule]

You can check in causality chain. Information Overview

[jmazzeo]

Looks like I missed this reply...

You can do it as @P.Ghule mentions, or by adding the "Module" column in the Alerts View.