Exception configuration - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product
Cortex XDR
License
Pro
Creation date
2024-07-16
Last date published
2024-11-07
Category
Administrator Guide
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XDR/Cortex-XDR-Documentation
Abstract

Learn how to configure exceptions from your baseline policy.

To allow full granularity, Cortex XDR enables you to create exceptions from your baseline policy. With these exceptions, you can remove specific folders or paths from evaluation, or disable specific security modules. You can configure exception rules for Cortex XDR protection and prevention actions in a centralized location, and apply them across multiple profiles. The exceptions can be configured from SettingsException Configuration.

  • Alert Exclusion rules specify match criteria for alerts that you want to suppress.

  • IOC/BIOC Suppression rules exclude one or more indicators from an IOC or BIOC rule that takes action on specific behaviors.

  • Disable Injection and Prevention rules specify exceptions that bypasses a process from prevention modules and injections.

  • Disable Prevention rules specify granular exceptions to prevention actions triggered for your endpoints.

  • Legacy Agent Exceptions define prevention profile exception rules for all endpoints.

  • Support Exception rules generate exceptions based on files provided by the support team.

Prior to Cortex XDR version 3.5, Legacy Agent Exceptions and Support Exceptions were configured through their relevant profiles.

Starting with version 3.5, Cortex XDR enables you to manage the Legacy Agent Exceptions and Support Exception configurations from a central location and easily apply them across multiple profiles in the Agent Exceptions Management page. 

To manage the Prevention profile exceptions from Exception Configuration, you must first migrate your existing exceptions configured via profiles. Your existing exception profiles are migrated per module.

Cortex XDR simulates the migration to enable you to review the results before activating the migration.

How to migrate existing exceptions
  1. Select SettingsException ConfigurationLegacy Exceptions and click Start Simulation.

  2. Review the Legacy Agent Exceptions and the Support Exception Rules.

  3. You can then Activate the new agent management page or Cancel to continue using the Prevention Profiles to configure individual exceptions.

Important

If you don't migrate the legacy exceptions, you can continue to create exceptions through the profiles.

After the migration, you can Add a support exception rule or Add a legacy exception rule.Add a support exception ruleAdd a legacy exception rule