topic Re: USB Flash Drives in Cortex XSIAM Discussions

USB Flash Drives

O.Faheem — Fri, 13 Jun 2025 12:09:16 GMT

Hi, We are using Cortex XSIAM. Now, the challenge we are facing is that if anyone connects a USB flash drive that has been allowed to use a USB, their computer gets infected with malware.

What we want is for the user to connect to the USB, for a real-time scan to occur immediately after connection to the computer, and for a malware warning to appear on the user's screen, similar to how a traditional antivirus does.

Please advise how we can proceed.

Regards,
Osama

Re: USB Flash Drives

mavega — Mon, 16 Jun 2025 22:48:28 GMT

Hello,

Thanks for reaching LC.

This is not an available option for XSIAM as it does not work as a traditional antivirus.

However, you can create a Restriction Profile and block any file execution from external drives.

You can find more information here:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Set-up-restrictions-prevention-profiles#

Re: USB Flash Drives

O.Faheem — Mon, 16 Jun 2025 23:44:33 GMT

Hi,

Thanks for your reply.

For my understanding Cortex XSIAM unifies best-in-class functions such as Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), Security Orchestration, Automation, and Response (SOAR), Attack Surface Management (ASM), and more within a single platform.

So, if these features are there then why EDR or XDR is not able to detect in real-time

Regards,

Osama Faheem