About JesseBaxter

Hello,   I have a system running workloads that is sensitive to CPU usage. The primary users have raised an issue that our currently applied XDR profile is causing detrimental delays in job processing. I confirmed this by disabling the agent to observe baseline activity. The current profile/policy has Exploit and Malware prevention set to "monitor only'.  Posting here hoping for some recommendations how to address the performance issues, as I'm not the most familiar with Cortex XDR yet. The system pulls reports from internal NAS, combines them using a variety of batch jobs, and sends them off. The user provided the following description when I inquired about process exclusions:  As far as "processes" go, the primary processes are the Poster process, which is a number of batch scripts and PosterWatcher.exe. The scripts that make up the batch processing system, Poster.cmd and PostForm.cmd primarily use built-in commands and executables. It's also possible that they call MQRequestClient.exe. There is also NT.Combine.cmd which primarily also uses built-in commands.  Given the context, what would be some appropriate strategies to exclude some of the sensitive workloads? I don't want to take a blunt approach such as whitelisting cmd.exe completely.  Thanks in advance! Jesse    ... View more