topic Re: Blocking Bluetooth in Cortex XDR Discussions

Blocking Bluetooth

JahidAliyev — Wed, 13 Mar 2024 08:33:09 GMT

Hello,

I want to block blueotooth activities on endpoints in Cortex XDR. Is there any way or rule to do this? If yes, can you write rule?

Thanks in advance.

jmazzeo — Wed, 13 Mar 2024 16:48:43 GMT

Hi @JahidAliyev, thanks for reaching us using the Live Community.

You can run a XQL Query like this, to retrieve all the "device plug" events from your tenant:

preset = device_control | filter event_sub_type = ENUM.DEVICE_PLUG

Then look at the "action_device_bus_type" field in your results to check how is reported the Bluetooth devices in your endpoint.

Based on that value you can add a filter to that query than can work to create the BIOC rule.

preset = device_control | filter event_sub_type = ENUM.DEVICE_PLUG | filter action_device_bus_type = ENUM.YOURVALUE

Please check it and let me know how it goes.

E.Jafarov — Sat, 23 Nov 2024 11:20:58 GMT

Hello JahidAliyev,

You can use Device Configuration Profile to block bluetooth devices