Temporarily allow USB without Internet connection (connecting to Portal)

SeanDeHarris — Tue, 25 Jul 2023 03:41:59 GMT

Hello, experts,

Found out the Device control which can be temporarily allowed to my USB device when my EP is connecting to the Internet/XDR Portal.

Just wondering if we could temporarily allow the USB without (the EP) connecting to Portal?

Thanks,

SdG

Re: Temporarily allow USB without Internet connection (connecting to Portal)

PiyushKohli — Tue, 25 Jul 2023 08:57:09 GMT

Hi @SeanDeHarris

Thank you for writing to live community!

Indeed in Device Control we have Device Temporary exceptions where you may allow your USB temporarily on selected or all endpoint. However the policy has to be enforced to the agent which will happen in next heartbeat (or by doing manual agent check-in) and therefore endpoint must be connected to Internet/XDR Portal.

Once endpoint running with XDR agent received updated policy then even if the endpoint is not connected to Portal (USB Temporary exception will continue to work).

Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Device-Control

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

topic Temporarily allow USB without Internet connection (connecting to Portal) in Cortex XDR Discussions

Temporarily allow USB without Internet connection (connecting to Portal)

Re: Temporarily allow USB without Internet connection (connecting to Portal)