Temporarily allow USB without Internet connection (connecting to Portal)

[SeanDeHarris]

Hello, experts,

Found out the Device control which can be temporarily allowed to my USB device when my EP is connecting to the Internet/XDR Portal. 

Just wondering if we could temporarily allow the USB without (the EP) connecting to Portal?

Thanks,

SdG

[PiyushKohli]

Hi @SeanDeHarris 

Thank you for writing to live community!

Indeed in Device Control we have Device Temporary exceptions where you may allow your USB temporarily on selected or all endpoint. However the policy has to be enforced to the agent which will happen in next heartbeat (or by doing manual agent check-in) and therefore endpoint must be connected to Internet/XDR Portal.

Once endpoint running with XDR agent received updated policy then even if the endpoint is not connected to Portal (USB Temporary exception will continue to work).

Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Device-Cont...

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.