Device Control - Continue to Block, but not create a Violation

KRisselada — Mon, 23 Aug 2021 20:19:29 GMT

With regard to leveraging Device Control Profile and Policies, with regard to Disable USB Hard Drive. Am I missing what is the process to continue to BLOCK a USB Hard Drive, but to not generate a Violation entry for it.

Use Case:
We are aware of this activity for a specific Device/Vendor (Sony camera, but shows up as Hard Drive as it has a drive associated with it) We want to continue to block this, but we no longer want to see it show up in the Device Control Violations table.

Is this possible?
Thanks in advance for any recommendations or resource / reference link I may have missed to accomplish this.

Re: Device Control - Continue to Block, but not create a Violation

tvilas — Wed, 01 Sep 2021 22:20:23 GMT

Hello,

Currently, there is no way to suppress these violations. Although you can try to hide row the hostname or GUID or type, this will only change your user view. right-click and you will see an option of "Hide rows with..." as shown in the example:

topic Device Control - Continue to Block, but not create a Violation in Cortex XDR Discussions

Device Control - Continue to Block, but not create a Violation

Re: Device Control - Continue to Block, but not create a Violation