Monitoring Bluetooth

[O.Faheem]

Hi,

We are using Cortex XSIAM. Now we want to perform monitoring of Bluetooth in Microsoft Windows 10 and 11 computers. The reason we want to check whether our users are connecting their mobile phones, like iPhone and Androids, through their office laptop using Bluetooth

Cortex XSIAM Cortex XDR 

[susekar]

Hello @O.Faheem ,

Greetings for the day.

Yes, you can monitor and control Bluetooth connections on Windows 10 and 11 computers using Cortex XSIAM. This functionality is available starting with Cortex XDR Agent version 8.6.

 

Requirements

• Agent Version: Cortex XDR Agent 8.6 or later

• Operating System: Windows 10 (Version 1809 and later) or Windows 11

 

Configuration Steps:

To monitor or block mobile phone connections via Bluetooth, configure a Device Control policy within an Extensions profile:

1. Navigate to Endpoints → Policy Management → Prevention → Profiles.

2. Create or edit a Windows Device Configuration profile.

3. Locate the Bluetooth Devices section.

Monitor Only:

• Set the policy to Allow.

• Ensure Device Control logging is enabled to capture connection events.

Block Mobile Phones

• Choose Custom settings.

• Under Bluetooth Classic services, select categories such as Phone (including smartphone subcategories) to block.

• Optionally, block specific Low Energy (LE) services if needed.

 

Monitoring and Detection:

Bluetooth connection events and data transfer activities are logged in XSIAM and can be queried using XQL.

Example query:

dataset = device_control_logs 
| filter device_type = "Bluetooth" 
| limit 100

---

Important Considerations and Limitations:

• Existing Connections: Devices already paired when a block policy is applied may not be immediately disconnected. For the policy to take effect, manually unpair the device or restart the computer.

• Phone Link Bypass: Microsoft Phone Link may bypass Bluetooth-only file transfer blocks because it can use Wi-Fi or mobile data for transfers after the initial pairing.

• Outbound Transfer Issues: Some agent versions (8.6–8.8) may not consistently block outbound file transfers from laptop to phone; this is resolved in Agent 8.9.

• Granularity: Serial numbers for Bluetooth devices are not currently extracted; exceptions are typically based on Vendor ID and Product ID.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar