Can you disable the ability to use the Live Terminal feature in Cortex XDR?
Can you disable the ability to use the Live Terminal feature in Cortex XDR?
Yes, it is possible to disable the ability to use the Live Terminal feature in Cortex XDR. This can be achieved via the Cortex XDR console or by using specific installation switches that configure the agent accordingly. This allows administrators to customize the functionality of the Cortex XDR agents on their endpoints as needed.
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Install-the-Cortex-XDR-Agent-Manually You can permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a Initiate a Live Terminal Session remote session on the endpoint, Run Scripts on an Endpoint on the endpoint, and Retrieve Files from an Endpoint from the endpoint to Cortex XDR. Disabling any of these payloads in the Config.xml file is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall your Cortex XDR agent and install a new agent with the corresponding values in the Config.xml file.