Endpoint protection from Virtual Applications like VM ware

[S.Jagushte774563]

Hello,

Does anyone have a solution for protecting Endpoint/Hosts from installed virtual machine's access to host resources or file sharing into hosts for the given scenarios

1. Cannot block installation of VM ware category applications or path.

2. Cannot install persistent or non persistent VDI agents

[jmazzeo]

Hi @S.Jagushte774563, thanks for reaching us using the Live Community.

1- Maybe the best option here is to create a BIOC rule using the VMware/VBox/x installer signatures to block the execution.

2- I don't get this one, you mean install the agent in non-persistent sessions? Here is a procedure for that in our doc: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.3/Cortex-XDR-Agent-Administrator-Guide/Corte...

[S.Jagushte774563]

Hello Jmazzeo,

Thankyou for taking notice. I will further explain my problem.

Our Endpoints have XDR agents installed now prevention, restriction and extension policies are in place working fine. After installing VMware type software and running a Virtual OS, access to USB and copying data/file to the host OS is possible. Which means the policies stay ineffective. I want a solution to this problem without restricting installation of such software.

[aspatil · Accepted solution]

Hello @S.Jagushte774563 ,

XDR agent being installed on the Endpoint will not have control over the VM until and unless it has XDR agent installed on it. Hence, to block the USB access your VM must has Cortex XDR agent installed.

Also XDR being not a DLP solution, we don't have a control on data flow. This is DLP functionality.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.