topic Re: Endpoint protection from Virtual Applications like VM ware in Cortex XDR Discussions

Endpoint protection from Virtual Applications like VM ware

S.Jagushte774563 — Tue, 27 Feb 2024 08:30:52 GMT

Hello,

Does anyone have a solution for protecting Endpoint/Hosts from installed virtual machine's access to host resources or file sharing into hosts for the given scenarios

1. Cannot block installation of VM ware category applications or path.

2. Cannot install persistent or non persistent VDI agents

Re: Endpoint protection from Virtual Applications like VM ware

jmazzeo — Tue, 27 Feb 2024 12:43:56 GMT

Hi @S.Jagushte774563, thanks for reaching us using the Live Community.

1- Maybe the best option here is to create a BIOC rule using the VMware/VBox/x installer signatures to block the execution.

2- I don't get this one, you mean install the agent in non-persistent sessions? Here is a procedure for that in our doc: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.3/Cortex-XDR-Agent-Administrator-Guide/Cortex-XDR-Agent-for-Virtual-Environments-and-Desktops

Re: Endpoint protection from Virtual Applications like VM ware

S.Jagushte774563 — Wed, 28 Feb 2024 06:36:39 GMT

Hello Jmazzeo,

Thankyou for taking notice. I will further explain my problem.

Our Endpoints have XDR agents installed now prevention, restriction and extension policies are in place working fine. After installing VMware type software and running a Virtual OS, access to USB and copying data/file to the host OS is possible. Which means the policies stay ineffective. I want a solution to this problem without restricting installation of such software.

Re: Endpoint protection from Virtual Applications like VM ware

aspatil — Wed, 28 Feb 2024 09:54:56 GMT

Hello @S.Jagushte774563 ,

XDR agent being installed on the Endpoint will not have control over the VM until and unless it has XDR agent installed on it. Hence, to block the USB access your VM must has Cortex XDR agent installed.

Also XDR being not a DLP solution, we don't have a control on data flow. This is DLP functionality.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.