Cortex XDR Agent restricts mobile phones from transferring data to PC through USB

[yuyangab]

Hi everyone!

Customer needs: when all mobile phones are connected to a PC through USB, only data from the phone is allowed to be transferred to the PC, and data from the PC is not allowed to be transferred to the phone, which means the phone is in read-only mode.

By viewing information in Device Control Violations, I now know that all phones are recognized as' Windows Portable Devices' type,

Then I tried to create a read-only profile for Windows Portable Devices in the Extensions Profiles Device Configuration, but there was no read only option. Why Disk Drives have read only option..

This method won't work,I try to create a Device Permanent Exceptions to permanently exclude different types of phones, but Permission cannot be change.

I can't think of any other way to do it, can anyone help me with how to configure and implement this customer requirement?

[nsinghvirk · Accepted solution]

Hello @yuyangab 

Thanks for reaching out on LiveCommunity.

Unfortunately you can only configure a USB/Windows portable device in block or allow mode. Disk drives however have the third mode of Read-only. Creating a permanent or temporary exception will also allow both read and write operations for windows portable devices.

Our recommendation is to only allow portable device access for select devices for which it absolutely necessary and block for rest. 

If you want to view the connect and disconnect events of USB devices, please refer this link.