USB SCANING

[RISALAZAR]

Hello Community, does Cortex scan USB devices for malware by default when they are inserted? Thank you. 

[kiwi]

Hi @RISALAZAR ,

In short, no.

Administrators often configure a Scheduled Scan just for compliance reasons or peace of mind.  Whether a scheduled scan includes USB devices depends entirely on how the scan scope was defined when the policy was created. By default, it usually does not automatically include them. 

Even if the config is changed to include USBs, the scan will only occur if the device is plugged in at the exact moment the scheduled timer hits.

Including USBs in a scheduled scan is not the default behavior; it requires a specific policy modification to include removable media in the scan scope.

Additional info:

• https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Scan-an-endpoint-...
• https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Endpoint-protecti... (Removable media)
• https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Endpoint-protecti... (Restricted execution - removable media)

Hope this helps,