Import File Hash Exceptions - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product
Cortex XDR
License
Pro
Creation date
2023-10-31
Last date published
2024-03-19
Category
Administrator Guide
Abstract

You can import file hash exceptions from the Endpoint Security Manager or from external feeds.

The Action Center page displays information on files quarantined and included in the allow list and block list. To import hashes from the Endpoint Security Manager or from external feeds, you can initiate an action.

  1. From Cortex XDR , select Incident ResponseResponseAction Center+ New Action.

  2. Select Import Hash Exceptions.

  3. Drag your Verdict_Override_Exports.csv file to the drop area.

    If necessary, resolve any conflicts encountered during the upload and retry.

  4. Click Next twice.

  5. Review the action summary, and click Done.

    Cortex XDR imports and then distributes your hashes to the allow list and block list based on the assigned verdict.