topic Re: XDR blocking thunderbolt mac docks in Cortex XDR Discussions

XDR blocking thunderbolt mac docks

Daniel_Itenberg — Tue, 16 Nov 2021 13:56:40 GMT

Hi all, question - can the XDR block a thunderbolt dock for macs? furthermore - all device control violations logged in the xdr main console, right?

Re: XDR blocking thunderbolt mac docks

epalcev — Wed, 17 Nov 2021 08:05:39 GMT

Hi Daniel,

Yes. As long as you insert a storing device to the thunderbolt it will detect it and block it (if this is what is configured in the policy).

Re: XDR blocking thunderbolt mac docks

WSeldenIII — Wed, 17 Nov 2021 16:31:44 GMT

Hi @Daniel_Itenberg, to address the second part of your question, you can monitor device control violations by navigating to Endpoints > Device Control Violations within the XDR App.

Re: XDR blocking thunderbolt mac docks

Daniel_Itenberg — Thu, 18 Nov 2021 09:03:02 GMT

So if I set up the policy to block all disk drives, then if i connect a disk drive to a dock the dock will be blocked as well?

Re: XDR blocking thunderbolt mac docks

Daniel_Itenberg — Thu, 18 Nov 2021 09:04:25 GMT

Here's the thing - I see the disk drive violation, however I don't the dock that is reportedly being blocked as well(when it has a disk drive connected) does not show up in the violations screen

Re: XDR blocking thunderbolt mac docks

bbarmanroy — Thu, 18 Nov 2021 10:23:46 GMT

This is most likely because your Thunderbolt dock is not a disk drive, but a dock/hub.

You can try the following sequence to see if this works for you:

1. Verify if the Thunderbolt dock connect/disconnect action in is being detected via the following XQL query:

dataset = xdr_data
| filter event_type = DEVICE and event_sub_type = DEVICE_PLUG
| fields action_device_usb_product_nam

If you're able to verify the dock is getting registered as a USB device, proceed to the following steps:

2. Add the Thunderbolt dock serial number/GUID under Policy Management -> Settings -> Device Management.

3. Add the device your Device Configuration Profile under "Custom Device Type" and Action as "Block".

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/hardened-endpoint-security/device-control.html