Cortex XDR _USB Blocking Levels

[Seth_Sakshi]

Hello,

Please let me understand the levels of usb blocking in the edr policy.

If the access is blocked does it allow printers, Charging smartphones, Other utilities like Cameras etc. 

Thanks in advance.

[nsinghvirk · Accepted solution]

Hello @Seth_Sakshi ,

Thanks for reaching out on LiveCommunity!

By default XDR allow you to control access for following device types:

Disk Drives (Block/Allow/Read Only)

CD-ROM Drives (Block/Allow)

Windows Portable Devices (Block/Allow)

Floppy Disk Drives (Block/Allow)

Apart from above devices classes, XDR also allow you to define custom device classes. When you create a custom device class, you must supply Cortex XDR the official ClassGuid identifier used by Microsoft. In this way you can control access for new device classes like printer, camera etc.

Please follow below link to define new device class.

https://docs-cortex.paloaltonetworks.com/r/nnVkSO1wKch8BsAwIvVNXg/lobX4efKM4a41mH~GQr0hg?section=UUI...

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[Seth_Sakshi]

Hello @nsinghvirk ,

Thanks for the solution.

Can you please tell which device class be used for enabling the USB access only for digital signature dongle?

Or Is there any other way by which we can allow only the use of digital signature dongle and block the access for rest of the use?

Thanks in advance.

Regards,

Sakshi Seth