The user can use the Malware Protection profile to configure malware protection in the Cortex XDR

console. The Malware Protection profile defines the actions that Cortex XDR takes when it detects

malware on your endpoints. You can configure different actions for different types of malware, such

as ransomware, password theft, or child process. You can also configure the scan frequency and

scope for periodic malware scans. The Malware Protection profile is part of the Endpoint Security

policy that you assign to your endpoints. Reference:

Malware Protection Profile

Endpoint Security Policy

The Managed Threat Hunting (MTH) team is a group of security experts who proactively hunt for

threats in the Cortex XDR tenant and generate a report with the findings. The MTH team uses

advanced queries and investigative actions to identify and analyze potential threats, such as zero-day

exploits, that may have bypassed the prevention and detection capabilities of Cortex XDR. The MTH

team also provides recommendations and best practices to help customers remediate the threats

and improve their security posture. Reference:

Managed Threat Hunting Service

Managed Threat Hunting Report

The Wildfire analysis file size limit for Windows PE files is 100MB. Windows PE files are executable

files that run on the Windows operating system, such as .exe, .dll, .sys, or .scr files. Wildfire is a

cloud-based service that analyzes files and URLs for malicious behavior and generates signatures and

protections for them. Wildfire can analyze various file types, such as PE, APK, PDF, MS Office, and

others, but each file type has a different file size limit. The file size limit determines the maximum

size of the file that can be uploaded or forwarded to Wildfire for analysis. If the file size exceeds the

limit, Wildfire will not analyze the file and will return an error message.

According to the Wildfire documentation1, the file size limit for Windows PE files is 100MB. This

means that any PE file that is larger than 100MB will not be analyzed by Wildfire. However, the

firewall can still apply other security features, such as antivirus, anti-spyware, vulnerability

protection, and file blocking, to the PE file based on the security policy settings. The firewall can also

perform local analysis on the PE file using the Cortex XDR agent, which uses machine learning

models to assess the file and assign it a verdict2.

Reference:

WildFire File Size Limits: This document provides the file size limits for different file types that can be

analyzed by Wildfire.

Local Analysis: This document explains how the Cortex XDR agent performs local analysis on files that

cannot be sent to Wildfire for analysis.

To automatically convert leads into alerts after investigating a lead, you should create IOC rules

based on the set of the collected attribute-value pairs over the affected entities concluded during the

lead hunting. IOC rules are used to detect known threats based on indicators of compromise (IOCs)

such as file hashes, IP addresses, domain names, etc. By creating IOC rules from the leads, you can

prevent future occurrences of the same threats and generate alerts for them. Reference:

PCDRA Study Guide, page 25

Cortex XDR 3: Handling Cortex XDR Alerts, section 3.2

Cortex XDR Documentation, section “Create IOC Rules”

The Broker VM is a virtual machine that you can deploy in your network to provide various services

and functionalities to the Cortex XDR agents. One of the services that the Broker VM offers is the

Local Agent Settings applet, which allows you to configure the agent proxy, agent installer, and

content caching settings for the agents. The Local Agent Settings applet can support a maximum

number of 10,000 agents per Broker VM. If you have more than 10,000 agents in your network, you

need to deploy additional Broker VMs and distribute the load among them. Reference:

Broker VM Overview: This document provides an overview of the Broker VM and its features,

requirements, and deployment options.

Configure the Broker VM: This document explains how to install, set up, and configure the Broker VM

in an ESXi environment.

Manage Broker VM from the Cortex XDR Management Console: This document describes how to

activate and manage the Broker VM applets from the Cortex XDR management console.

Palo Alto Networks provides a set of precanned scripts that you can use to perform various actions

on your endpoints, such as deleting files, killing processes, or quarantining malware. The precanned

scripts are written in Python and are available in the Agent Script Library in the Cortex XDR console.

You can use the precanned scripts as they are, or you can customize them to suit your needs. The

precanned scripts are:

delete_file: Deletes a specific file from a local or removable drive.

quarantine_file: Moves a specific file from its location on a local or removable drive to a protected

folder and prevents it from being executed.

process_kill_name: Kills a process by its name on the endpoint.

process_kill_pid: Kills a process by its process ID (PID) on the endpoint.

process_kill_tree: Kills a process and all its child processes by its name on the endpoint.

process_kill_tree_pid: Kills a process and all its child processes by its PID on the endpoint.

process_list: Lists all the processes running on the endpoint, along with their names, PIDs, and

command lines.

process_list_tree: Lists all the processes running on the endpoint, along with their names, PIDs,

command lines, and parent processes.

process_start: Starts a process on the endpoint by its name or path.

registry_delete_key: Deletes a registry key and all its subkeys and values from the Windows registry.

registry_delete_value: Deletes a registry value from the Windows registry.

registry_list_key: Lists all the subkeys and values under a registry key in the Windows registry.

registry_list_value: Lists the value and data of a registry value in the Windows registry.

registry_set_value: Sets the value and data of a registry value in the Windows registry.

The script list_directories is not a precanned script provided by Palo Alto Networks. It is a custom

script that you can write yourself using Python commands.

Reference:

Run Scripts on an Endpoint

Agent Script Library

Precanned Scripts

WildFire is a cloud-based service that accepts and analyses samples from various sources, including

Cortex XDR, to provide a verdict of malware, benign, or grayware. WildFire also generates detailed

analysis reports that show the behaviour and characteristics of the samples. Cortex XDR uses

WildFire verdicts and reports to enhance its detection and prevention capabilities, as well as to

provide more visibility and context into the threats. Reference:

WildFire Analysis Concepts

WildFire Overview

The policy exception that applies to the following description is B, local file threat examination

exception. A local file threat examination exception is an exception that allows you to exclude specific

files or folders from being scanned by the Cortex XDR agent for malware or threats. You can use this

exception to prevent false positives, performance issues, or compatibility problems with legitimate

files or applications. You can define the local file threat examination exception by file name, file path,

file hash, or digital signer. For example, you can create a local file threat examination exception for

specific PHP files by entering their file names or paths in the exception configuration. Reference:

Local File Threat Examination Exceptions

Create a Local File Threat Examination Exception

The report output shows the number of endpoints that have forensic inventory data collection

enabled, which is a feature of Cortex XDR that allows the collection of detailed information about the

endpoint’s hardware, software, and network configuration. This feature helps analysts to investigate

and respond to incidents more effectively by providing a comprehensive view of the endpoint’s state

and activity. Forensic inventory data collection can be enabled or disabled per policy in Cortex

XDR. Reference:

Forensic Inventory Data Collection

Cortex XDR 3: Getting Started with Endpoint Protection

When reaching out to TAC for additional technical support related to a security event, two critical

pieces of information you need to collect from the agent are:

The agent technical support file. This is a file that contains diagnostic information about the agent,

such as its configuration, status, logs, and system information. The agent technical support file can

help TAC troubleshoot and resolve issues with the agent or the endpoint. You can generate and

download the agent technical support file from the Cortex XDR console, or from the agent itself.

The prevention archive from the alert. This is a file that contains forensic data related to the alert,

such as the process tree, the network activity, the registry changes, and the files involved. The

prevention archive can help TAC analyze and understand the alert and the malicious activity. You can

generate and download the prevention archive from the Cortex XDR console, or from the agent itself.

The other options are not critical pieces of information for TAC, and may not be available or relevant

for every security event. For example:

The distribution id of the agent is a unique identifier that is assigned to the agent when it is installed

on the endpoint. The distribution id can help TAC identify the agent and its profile, but it is not

sufficient to provide technical support or forensic analysis. The distribution id can be found in the

Cortex XDR console, or in the agent installation folder.

A list of all the current exceptions applied to the agent is a set of rules that define the files,

processes, or behaviors that are excluded from the agent’s security policies. The exceptions can help

TAC understand the agent’s configuration and behavior, but they are not essential to provide

technical support or forensic analysis. The exceptions can be found in the Cortex XDR console, or in

the agent configuration file.

The unique agent id is a unique identifier that is assigned to the agent when it registers with Cortex

XDR. The unique agent id can help TAC identify the agent and its endpoint, but it is not sufficient to

provide technical support or forensic analysis. The unique agent id can be found in the Cortex XDR

console, or in the agent log file.

Reference:

Generate and Download the Agent Technical Support File

Generate and Download the Prevention Archive

Cortex XDR Agent Administrator Guide: Agent Distribution ID

Cortex XDR Agent Administrator Guide: Exception Security Profiles

[Cortex XDR Agent Administrator Guide: Unique Agent ID]