block file on specific endpoint cortex agent

[Angelicasmm]

Hello, I want to block an executable in the Cortex agent configuration but on a specific endpoint. can you help me? thank you

Cortex XDR 

[Vinothkumar_SBA · Accepted solution]

Hi@Angelicasmm,

First, create a new Restrictions profile and add a block list for executable files. The next step is to create the policy and add the newly created Restrictions profile. Select the targeted endpoints. Once you finish the configuration, go to 'All Endpoints,' select the targeted endpoints, and check if the new policy has been assigned or not.

Please check the following link for restriction creation steps: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-R....

Hope this answers your query. Please mark the response as "Accept as solution" if it helps.