Add a New Restrictions Security Profile

Add a new profile.
From
Cortex
XDR
, select
Endpoints
Policy Management
Prevention
Profiles
+ New Profile
and select whether to
Create New
or
Import from File
a new profile.
New imported profiles are added and not replaced.
Select the platform to which the profile applies and
Restrictions
as the profile type.
Click
Next
.
Define the basic settings.
Enter a unique
Profile Name
to identify the profile. The name can contain only letters, numbers, or spaces, and must be no more than 30 characters. The name you choose will be visible from the list of profiles when you configure a policy rule.
To provide additional context for the purpose or business reason that explains why you are creating the profile, enter a profile
Description
. For example, you might include an incident identification number or a link to a help desk ticket.
Configure each of the Restrictions Endpoint Protection Capabilities.
Configure the action to take when a file attempts to run from a specified location.
Block
—Block the file execution.
Notify
—Allow the file to execute but notify the user that the file is attempting to run from a suspicious location. The
Cortex
XDR
agent also reports the event to
Cortex
XDR
.
Report
—Allow the file to execute but report it to
Cortex
XDR
.
Disabled
—Disable the module and do not analyze or report execution attempts from restricted locations.
Add files to your allow list or block list, as needed.
The type of protection capability determines whether the capability supports an allow list, block list, or both. With an allow list, the action mode you configure applies to all the paths except for those that you specify. With a block list, the action applies only to the paths that you specify.
+Add
a file or folder.
Enter the path and press
Enter
or click the check mark when done. You can also use a wildcard to match a partial name for the folder and environment variables. Use
?
to match any single character or
*
to match any string of characters. To match a folder, you must terminate the path with * to match all files in the folder (for example,
c:\temp\*
).
Repeat to add additional folders.
Save
the changes to your profile.
Apply Security Profiles to Endpoints.
You can do this in two ways: You can
Create a new policy rule using this profile
from the right-click menu or you can launch the new policy wizard from
Policy Rules
.