In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?
In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?
To prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer, you should create a new rule exception and use the signer as the characteristic. This approach allows you to specify the trusted signers directly, ensuring that all files signed by these entities are not blocked by the agent.
the correct option to prevent the Cortex XDR Agent from blocking the execution of a file based on the digital signer may vary depending on the specific version and configuration of the Cortex XDR Agent. However, based on the given options, the most appropriate choice would be: C. Add the signer to the allow list in the malware profile. By adding the digital signer to the allow list in the malware profile, you are essentially telling the Cortex XDR Agent to trust files signed by that specific signer and allow their execution without being blocked. It's worth noting that cybersecurity measures and software configurations can change over time, so it's essential to refer to the official documentation or the latest guidelines provided by the product's vendor for the most up-to-date information. Additionally, configuring security software requires careful consideration and should be performed by knowledgeable and authorized personnel to ensure the system's security.
Option A will allow only a specific executable while option C will allow this Signer in general which is the point of this question.
https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/blocking-of-ioc-in-cortex-xdr/td-p/516052 changing answer to A
sorry this is the wrong question for this answer, I still believe it to be C
I agree with C based on links below
I'd say C is for 3.5 version and older and B is for newer versions: "Add a Disable Prevention Rule Cortex XDR enables you to generate granular exceptions to prevention actions defined for your endpoints. You can specify signers, command line, or processes to exclude from the prevention actions triggered by specific security modules. This may be useful when you have processes that are essential to your organization and must not be terminated. Cortex XDR still generates Alerts from the disabled rules." Checking inside my client's platform that's what I can see and we're running 3.7 currently. Info taken from here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-Disable-Prevention-Rule