Endpoint protection from Virtual Applications like VM ware

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Endpoint protection from Virtual Applications like VM ware




Does anyone have a solution for protecting Endpoint/Hosts from installed virtual machine's access to host resources or file sharing into hosts for the given scenarios

1. Cannot block installation of VM ware category applications or path.

2. Cannot install persistent or non persistent VDI agents



L4 Transporter

Hi @S.Jagushte774563, thanks for reaching us using the Live Community.


1- Maybe the best option here is to create a BIOC rule using the VMware/VBox/x installer signatures to block the execution.

2- I don't get this one, you mean install the agent in non-persistent sessions? Here is a procedure for that in our doc: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.3/Cortex-XDR-Agent-Administrator-Guide/Corte...


Hello Jmazzeo,


Thankyou for taking notice. I will further explain my problem.


Our Endpoints have XDR agents installed now prevention, restriction and extension policies are in place working fine. After installing VMware type software and running a Virtual OS, access to USB and copying data/file to the host OS is possible. Which means the policies stay ineffective. I want a solution to this problem without restricting installation of such software.



L4 Transporter

Hello @S.Jagushte774563 ,


XDR agent being installed on the Endpoint will not have control over the VM until and unless it has XDR agent installed on it. Hence, to block the USB access your VM must has Cortex XDR agent installed.

Also XDR being not a DLP solution, we don't have a control on data flow. This is DLP functionality.


If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Ashutosh Patil
  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!