topic Re: Plans to use device control violation / permanent exceptions in RBAC mode? in Cortex XDR Discussions

Plans to use device control violation / permanent exceptions in RBAC mode?

RFeyertag — Mon, 06 Jan 2025 20:57:18 GMT

Hello dear community,

we have 2 groups in the Dashboard. The client os team and the incl. server os team. Only the server os team can use the device permanent exceptions for device control.

Are there any plans to solve this issue?

RBAC is nice, but it is not implemented proper.

Rob

Re: Plans to use device control violation / permanent exceptions in RBAC mode?

nsinghvirk — Wed, 15 Jan 2025 16:36:08 GMT

Hello @RFeyertag

Thanks for reaching out on LiveCommunity!

You can create a custom roles for server os team and client os team. You can configure permissions for them for device control settings accordingly as shown in screenshot.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Plans to use device control violation / permanent exceptions in RBAC mode?

RFeyertag — Sat, 25 Jan 2025 18:30:58 GMT

Hello @nsinghvirk !

This is not working when you have RBAC activated. We have two teams, Cortex-IT operations with scope on client OS (there we need the permanent exclusions) and the Cortex Admins (they can do everything).

Rob

PS: we allready had a conversation about this: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/rbac-scoped-through-tags-no-exceptions-for-device-control/m-p/572005#M5844