USB SCANING

RISALAZAR — Mon, 04 May 2026 19:24:45 GMT

Hello Community, does Cortex scan USB devices for malware by default when they are inserted? Thank you.

Re: USB SCANING

kiwi — Tue, 05 May 2026 07:49:11 GMT

In short, no.

Administrators often configure a Scheduled Scan just for compliance reasons or peace of mind. Whether a scheduled scan includes USB devices depends entirely on how the scan scope was defined when the policy was created. By default, it usually does not automatically include them.

Even if the config is changed to include USBs, the scan will only occur if the device is plugged in at the exact moment the scheduled timer hits.

Including USBs in a scheduled scan is not the default behavior; it requires a specific policy modification to include removable media in the scan scope.

Additional info:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Scan-an-endpoint-for-malware
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Endpoint-protection-capabilities (Removable media)
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Endpoint-protection-modules (Restricted execution - removable media)

Hope this helps,

topic Re: USB SCANING in Cortex XDR Discussions

USB SCANING

Re: USB SCANING