topic Cortex XDR _USB Blocking Levels in Cortex XDR Discussions

Cortex XDR _USB Blocking Levels

Seth_Sakshi — Wed, 06 Dec 2023 04:47:40 GMT

Hello,

Please let me understand the levels of usb blocking in the edr policy.

If the access is blocked does it allow printers, Charging smartphones, Other utilities like Cameras etc.

Thanks in advance.

Re: Cortex XDR _USB Blocking Levels

nsinghvirk — Thu, 07 Dec 2023 12:39:15 GMT

Hello @Seth_Sakshi ,

Thanks for reaching out on LiveCommunity!

By default XDR allow you to control access for following device types:

Disk Drives (Block/Allow/Read Only)

CD-ROM Drives (Block/Allow)

Windows Portable Devices (Block/Allow)

Floppy Disk Drives (Block/Allow)

Apart from above devices classes, XDR also allow you to define custom device classes. When you create a custom device class, you must supply Cortex XDR the official ClassGuid identifier used by Microsoft. In this way you can control access for new device classes like printer, camera etc.

Please follow below link to define new device class.

https://docs-cortex.paloaltonetworks.com/r/nnVkSO1wKch8BsAwIvVNXg/lobX4efKM4a41mH~GQr0hg?section=UUID-1896b99e-5c92-65d8-3c4c-d2d9f9a5f44a_ideca69bf5-767c-41b1-a13d-7da15d2c481a

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Cortex XDR _USB Blocking Levels

Seth_Sakshi — Thu, 01 Feb 2024 12:02:47 GMT

Hello @nsinghvirk ,

Thanks for the solution.

Can you please tell which device class be used for enabling the USB access only for digital signature dongle?

Or Is there any other way by which we can allow only the use of digital signature dongle and block the access for rest of the use?

Thanks in advance.

Regards,

Sakshi Seth