Manage file execution - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation
Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-10-10
Category
Administrator Guide
Abstract

Set rules for the execution (or running) of particular files on your endpoints in Cortex XSIAM.

You can manage file execution on your endpoints by adding file hashes to your allow and block lists. If you trust a certain file and know it to be benign, you can add the file hash to the allow list. This allows the file to be executed on all your endpoints regardless of the WildFire or local analysis verdict. Similarly, if you want to always block a file from running on your endpoints, you can add the associated hash to the block list.

Adding files to the allow and block lists takes precedence of any other policy rules that are applied to these files. In the Action Center, you can monitor the allow and block list actions performed in your network, and add or remove files from these lists.

Supported file types are:

Operating system

Supported file types

Windows

  • PE, PE64

  • doc, docx, xls, xlsx (only if they contain macro files)

Mac

macho, DMG

Linux

ELF

How to add a file to the allow or block list or allow list

  1. Go to Incident Response → Response → Action Center → New Action.

  2. Select Add to Block List or Add to Allow List.

  3. Enter the SHA-256 hash of the file and click blue-arrow.png.

    You can add up to 100 file hashes at one time. If you add a comment, it is added to all the hashes you added in this action.

  4. Click Next.

  5. Review the summary and click Done.

    In the next heartbeat, the agent retrieves the updated lists from Cortex XSIAM .

  6. You are automatically redirected to the Block List or Allow List that corresponds to the action in the Action Center.

  7. To manage the file hashes on the Block List or the Allow List, right-click a file to see the available actions.