Storage Device Management

[AndrewBowden04]

We are in the process of blocking USB Storage devices using Cortex XDR. We have the Device Configuration Extension Policy setup with the settings we want. The issue that we have is that it can only be Allowed or Blocked. How can we set to just monitor at first? This way, we can watch the Device Control violations list for any storage devices that are found. We know we have some in the Org that will need to be allowed and would like to find those before they get blocked.

[eluis]

Hi @AndrewBowden04 

XDR is not a DLP solution so it does not provide all DLP features. Is not the intention of XDR to be a competitor in the DLP market for now. So unfortunately there is no monitor option so far. 

There are ways to open a New Feature Request, if you want so, please contact your PANW account representative for such. This does not mean that the NFR will be 100% implemented, this has to be evaluated and depending on many variables and factors a decision will be made. 

Decision is not provided to the customer since it might be a temporal No or a Yes without an implementation date. Meaning that it is difficult or better said impossible to give a fixed answer including a date of implementation.

But make sure that the NFR will be reviewed and taken into consideration internally. 

Please check the doc for features on device control:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Device-control

You can block or allow.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". 

Thank you.

Luis