About creddy

Hi @ReisingerM  Are you able to see which component of XDR agent is blocking file? The immediate workaround is, if the blocked file is trusted one, you can create exclusion for it to prevent from being blocked. Refer below article for same. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/investigate-endpoint-alerts/manage-alerts#id28f60556-5235-4f96-8bf6-0de0dbc94925_id89caf979-e8c4-4878-9b92-1951575e1c94 Aside to above, if the wildfire module is the one blocking the file here, you can also request a verdict review for a sample as per this documentation here under "Report an incorrect verdict to Palo Alto Networks": https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-response/investigate-files/review-wildfire-analysis-details.html You could also create file level exclusions in Malware profile policy. This will help to exclude the file even when the file hash changed as part of its software updates. Refer STEP 3 in link : https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-profiles/add-malware-security-profile I hope that helps to address your problem here.  However you can still log a case with support to get more help. ... View more

Hi @RFeyertag  Aside to above, to check if your agent proxy is working, You may run the following commands Windows C:\Program Files\Palo Alto Networks\Traps>cytool proxy query Mac Sudo /Library/Application\ Support/PaloAltoNetworks/Traps/bin/cytool proxy query Linux /opt/traps/bin/cytool proxy query The BVM IP address and port should be listed under Last good Proxy in the command output. If there is no Last Good Proxy, it means your agent cannot connect to Broker VM .If Proxy server is not configured properly, you can run this command to configure Proxy. “cytool proxy set X.X.X.X:YYYY” *replace X.X.X.X with BVM IP address and YYYY with BVM port   ... View more

Hi @RFeyertag  Just crossing through this question, felt like you still need help on this query. From XDR 3.4 version, Virus total option will not be displayed in Key Assets and Artifacts section. It will appear only when you have integrated the virus total with API key in XDR Settings as per below article. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash I hope that answers your query. Please mark this as solution if you find it helpful. Thank you! ... View more