topic Device Control in Cortex XDR Discussions

Device Control

efasoformoso — Fri, 08 Jan 2021 23:58:27 GMT

Can Cortex XDR prevent the use of other USB devices other than Disk Drives, CD-Rom Drives, and Floppy Disk Drives? If one of my users plugs in a printer, can that be denied? Can the same be done with SD cards?

Re: Device Control

dfalcon — Mon, 11 Jan 2021 19:19:18 GMT

Hi @efasoformoso-

The device control feature is designed to enforce USB-connected devices. If the device is connected via an external SD reader, you may be able to block - I would need to test to verify. You can also block execution from an SD-card by leveraging a restriction profile regardless if the reader is embedded or external.

You should be able to block the printer. Here is a list of Windows portable device classes (provided by Microsoft) that Cortex XDR can block.

https://docs.microsoft.com/en-us/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors

Additionally, you are able to create custom device classes.

Hope this helps.

Re: Device Control

efasoformoso — Fri, 15 Jan 2021 23:58:57 GMT

Thank you for the response!

Can printers be disallowed on macOS too?

Re: Device Control

dfalcon — Wed, 20 Jan 2021 20:25:14 GMT

Hi @efasoformoso-

At the current time, this is a Windows-only feature. It is based on the device class for Windows. macOS is limited to drives. See doc here:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/hardened-endpoint-security/device-control.html