topic Re: USB protection exeption for ClickShare usb Device in Cortex XDR Discussions

USB protection exeption for ClickShare usb Device

D.Meyer — Tue, 10 Dec 2024 13:14:23 GMT

Hello everybody,

if we block USB Drives/Windows drives our ClickShare (USB Screen Share Dongle) devices also get blocked.

But they don´t appear in the "Device Control Violations" list so we can´t exclude them from blocking.

We tried to exlude the path for the *.exe on the ClickShare but this seems not to work.

How can we exlude these ClickShare?

bstrgrds

Re: USB protection exeption for ClickShare usb Device

jmazzeo — Tue, 10 Dec 2024 20:44:15 GMT

Hi @D.Meyer, thanks for reaching us using the Live Community.

You can create permanent device exceptions under Endpoints - Policy Management - Extensions - Device Permanent Exceptions, you need to fill this fields in Common or Custom device types:

You should be able to get the product codes and serial numbers from the vendor.

If this post answers your question, please mark it as the solution.

Re: USB protection exeption for ClickShare usb Device

D.Meyer — Wed, 18 Dec 2024 09:29:15 GMT

Hello Again,

we tried this but the clickshare still get blocked and the block action can´t be seen unter "device violations".

Re: USB protection exeption for ClickShare usb Device

jmazzeo — Wed, 18 Dec 2024 17:26:34 GMT

Do you have any other kind of Alert in the XDR console? If the device is associated with an application in the system, this one may have some behavior that is suspicious for the XDR Agent and it's being blocked by a protection module.

Re: USB protection exeption for ClickShare usb Device

D.Meyer — Fri, 20 Dec 2024 14:28:02 GMT

Hello Jmazzeo,

unfortunately not. I see no incident related to this issue.

I looked at the "traps.log" File and found this:

2024/12/20T15:00:16.057+01:00 <Information> Computer [5124:7664 ] {trapsd:Main} ReportLowLevelEvent: 0x4040006a Data: 3A0000000100000002000000D42038815AE67755B84B8446C119897B0100000067E9364D25E3CE11BFC108002BE1031800000000000000000000
2024/12/20T15:00:16.057+01:00 <Information> Computer [5124:7664 ] {trapsd:DeviceControl} setting violation timer expiration to 0ms milliseconds
2024/12/20T15:00:16.057+01:00 <Information> Computer [5124:9816 ] {trapsd:AuditService:ThreadPool:DeviceControlViolations:} Audit: priority = 0, event_type = 11, body = {
"eventCategory": 57,
"bus": "usb",
"classGuid": "XXXXXXX",
"className": "disk"

It looks like the Device controll blocks it.

Re: USB protection exeption for ClickShare usb Device

RFeyertag — Fri, 20 Dec 2024 18:36:46 GMT

This is what I found, as we had the issue. We solved it with the support.

Re: USB protection exeption for ClickShare usb Device

Antony_Chan — Tue, 24 Dec 2024 07:33:03 GMT

@D.Meyer If your agent version is 8.6.0, there's a bug where the agent will continue blocking the device despite that the exception is in place. On top of that, the agent will not report back the event - hence it'll not show in the device violation page. Try reach out to support to create a SUEX. We got the same problem and the SUEX is the only workaround so far. TAC told us that 8.6.1 should solve this issue.

Re: USB protection exeption for ClickShare usb Device

M.ISSAKIDIS475991 — Wed, 08 Jan 2025 17:44:14 GMT

@Antony_Chan I am also facing the same issue on endpoint running 8.6.0 and not on endpoint running 8.6.1 so I can confirm that the new version solved the issue.

Also found this while checking Cortex Help Center :

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.6/Cortex-XDR-Agent-Release-Notes/Addressed-Issues-in-Cortex-XDR-Agent-8.6

Version 8.6.1 is scheduled for General Availability on January 20, 2025

Re: USB protection exeption for ClickShare usb Device

RFeyertag — Sat, 25 Jan 2025 18:34:35 GMT

Click&Share works and other issues with USB devices also were neutralized through 8.6.1.

Rob