This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About EddieRowe
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About EddieRowe
10-01-2020
15Posts
3Likes
1Solution
Oct 01, 2020Last Visited
User
Activity
User
Profile
Latest posts by EddieRowe
| Subject | Views | Posted |
|---|---|---|
| 1124 | 09-26-2020 06:10 PM | |
| 7870 | 09-25-2020 03:17 PM | |
| 7871 | 09-25-2020 03:15 PM | |
| 2505 | 09-18-2020 02:54 PM | |
| 4159 | 09-17-2020 12:45 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 09-04-2020 10:41 AM | |
| 1 Like | 09-18-2020 02:54 PM | |
| 1 Like | 09-15-2020 03:09 PM |
User Badges
Community Statistics
| Member Since | 08-24-2020 03:31 PM |
| Date Last Visited | 10-01-2020 01:14 PM |
| Posts | 15 |
| Total Likes Received | 3 |
09-26-2020
06:10 PM
It appears that Cortex XDR does not play well with the existing encryption product we use. There is no indication of any issues whatsoever, but when you attempt to decrypt the drive the application is not successful at decrypting all of the files. Uninstall Cortex XDR and things work -- the power of a VM proves it is an issue with Cortex. Initially I tried using the cytool to stop the File and Process protections. I moved on to creating a new policy that uses a new Malware Profile that excludes the folder and a new Exceptions Profile that includes the .EXE that performs the decryption -- I checked all of the modules for the exception. Anyone have any suggestions for how to work through an issue where Cortex just silently breaks software?
... View more
09-25-2020
03:17 PM
Ah, I see now... I overlooked the first picture! Thanks! I was not the original poster, but we appear to have a conflict with an encryption product.
... View more
09-25-2020
03:15 PM
My interpretation of the setting for exclusion for files in the Malware profile is only for dormant files when you use the weekly/monthly scan. How do you exclude an entire folder completely?
... View more
09-18-2020
02:54 PM
1 Kudo
It does appear the setting disappeared from my tenant as well! The online documentation no longer makes no mention of it, but I have the PDF version from last week so I have PROOF. 8-) Here is what the PDF copy of the manual had for the feature which was not mentioned anywhere in last week's release notes.
... View more
09-17-2020
12:45 PM
I appreciate the info - Pro was way outside of our budget. I thought for a moment I had overlooked something (and the Palo Alto person who helped with the PoC didn't share this) so it nice to get confirmation I should not see the BIOC options on the web console.
... View more
09-15-2020
03:09 PM
1 Kudo
@DKasabji, No it cannot be disabled any longer unless you have an Intune subscription per MS documentation (link below). Our GPO has had Windows Defender turned off for many years now going back to before we added Cortex XDR Prevent to our environment. (The prior solution did not disable automatically so we have always used the GPO setting.) The GPO setting is active and Defender has never been observed doing anything on our systems to my knowledge. But for some reason some systems, all running Win10 v1903, some systems have the Windows Defender Antivirus Service running and others do not. I am going to guess that this was an issue before Cortex XDR Prevent and it was just not noticed. We have an application misbehaving and the vendor claims Windows Defender is the cause so as part of my info gathering I noticed the service running on the system. https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection
... View more
09-15-2020
02:24 PM
Yes, Cortex XDR Prevent's Restrictions profile works as you described -- I tested the setup last week. The issue is that it is a maintenance nightmare...it was not really designed with this in mind. You can stop all .EXE files from running from the user profile, but to allow some to run is based on the filename/hash. AppLocker should allow me to setup things so that .EXE files signed by GotoMeeting are allowed, but not others. Oh, and Microsoft keeps stuffing Office 365 stuff under the user profile like Teams, OneDrive, etc.
... View more
09-15-2020
07:52 AM
I was hoping to do this with Cortex-XDR Prevent by blocking programs from running from the user profile, but the hashes change too often. I was hoping we could block everything from running and then allow some signed applications to run from the user profile. I have had AppLocker on the list for some time to learn about.
... View more
09-15-2020
07:42 AM
@tech_noob, doesn't ncat have legtimate uses so in and of itself it is not evil? Do you have the grayware protection enabled? (Just thinking out loud...I am not experienced with Kali or ncat.
... View more
09-15-2020
07:37 AM
@DKasabji, I am seeing some devices where Windows Defender Antivirus still have the service running. I disable it via GPO and surprised to see it running on my system. With the new tamper protections I have yet to figure out how to disable the service so it is like it is "off" but still running the app behind the scenes. We are not Intune subscribers so there does not appear to be a way to turn it off if Cortex fails to do so.
... View more
09-15-2020
07:33 AM
Isn't a "Perform Heartbeat " under right-click Endpoint Control the way to ask the endpoint to check-in before the 5 minute interval? While I have not had this issue with 7.1.3 Prevent, the first thing I would check is to ensure there are no blocks on your firewall to ensure there is not some odd communication issue.
... View more
09-15-2020
07:25 AM
Has anyone upgraded to the 7.2.0 agent yet that has experienced performance issues? Like most persons our environment is constantly changing, but at the suggestion of someone at Palo Alto I upgraded my system to the 7.2.0 release last Thursday for another issue. A day later, before installing the September 2020 patches, my system stopped responding (Friday). Task Manager would not open, nor did the <Ctrl> <Sht> <Esc? trick work. I suspended the laptop and when leaving sleep/standby the system "blue screened" with a code indicating it could not leave standby. On Monday the issue happened again where the system stopped responding, but still allowed me to interact with an existing RDP session. I logged into the web console and asked XDR to uninstall the agent from my system and the system resumed normal operation once that began to execute. I have reinstalled the 7.1.2 agent.
... View more
09-09-2020
07:43 AM
The admin guide was updated for this setting, even though the release notes were not updated.
... View more
09-08-2020
11:37 AM
I noticed that my tenant space has a new option in the Windows Malware Profile under Ransomware Protection that is named "Extend Ransomware Protection to SMB Shares". I don't believe this setting was available prior tot he 7.2 release that I read about today. I do not see anything in the release notes about this new setting/feature for 7.2 and went back to my Administrator's Guide and cannot find any reference to it there either so I don't think I overlooked it. Having to specify every file share seems a bit tedious...
... View more
09-04-2020
10:41 AM
1 Kudo
On some Win10 v1903 (x64) systems running 7.1.3 the Windows Defender Antivirus service is set to "manual" and others it is set to "automatic". I cannot make heads or tails of it. We setup our GPO way before Cortex XDR to turn off Windows Defender Antivirus. GPO Setting: Location: Computer Configuration - Administative Templates - Windows Components - Windows Defender Antivirus Setting: Turn off Windows Defender Antivirus - Set to Enabled (Enabled = it is not supposed to run or scan)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-01-2020
01:14 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks