XDR Shadow Copy use case

[YadnyayeePawar]

Could someone please share any related documents or use cases for the Shadow Copy in XDR? We have gone through the Administrative guide, but we were unable to find many details about how it works. Additionally, we would like to know how we can backup the data if an endpoint gets infected.

Cortex XDR 

[jtalton]

Hi YadnyayeePawar,

The use case is to allow our customers the ability to turn on automatic backups from XDR to ease the stress associated with managing backup tools when dealing with ransomware cases and to improve your security posture. 

Please review LIVEcommunity - Cortex XDR How-To Video: What's New in 3.8 which provides an overview of the feature.

If you found this answer helpful, please select Accept as Solution.

Thank you

[YadnyayeePawar]

We have already gone through these documents, and we would appreciate it if anyone would provide us with proper documentation on how shadow copy works and if there are any use cases available. 

[AbdBgc]

In the video mentioned by @jtalton it is said that "The backup is created only for files, it is not a restore point".!

But this is an absolute need.

[Fm12345]

Using this setting we are only enabling the windows functionality which is shadow copy (VSS) and in mac it is Time machine.

If during any malware or ransomeware if a file is affected, you have capability to restore that file using xdr console from remediation suggestion of the incident.