Device Control

[efasoformoso]

Can Cortex XDR prevent the use of other USB devices other than Disk Drives, CD-Rom Drives, and Floppy Disk Drives? If one of my users plugs in a printer, can that be denied? Can the same be done with SD cards?

[dfalcon]

Hi @efasoformoso-

The device control feature is designed to enforce USB-connected devices.  If the device is connected via an external SD reader, you may be able to block - I would need to test to verify.  You can also block execution from an SD-card by leveraging a restriction profile regardless if the reader is embedded or external.  

You should be able to block the printer.  Here is a list of Windows portable device classes (provided by Microsoft) that Cortex XDR can block.  

https://docs.microsoft.com/en-us/windows-hardware/drivers/install/system-defined-device-setup-classe...

Additionally, you are able to create custom device classes. 

Hope this helps.

[efasoformoso]

Thank you for the response!

Can printers be disallowed on macOS too?

[dfalcon]

Hi @efasoformoso-

At the current time, this is a Windows-only feature.  It is based on the device class for Windows.  macOS is limited to drives.  See doc here:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/hardened-...