USB Flash Drives

[O.Faheem]

Hi, We are using Cortex XSIAM. Now, the challenge we are facing is that if anyone connects a USB flash drive that has been allowed to use a USB, their computer gets infected with malware.
 
What we want is for the user to connect to the USB, for a real-time scan to occur immediately after connection to the computer, and for a malware warning to appear on the user's screen, similar to how a traditional antivirus does.
 
Please advise how we can proceed.
 
Regards,
Osama

[mavega]

Hello,

Thanks for reaching LC.

This is not an available option for XSIAM as it does not work as a traditional antivirus.

However, you can create a Restriction Profile and block any file execution from external drives.

You can find more information here:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Set-up-restrictio...

[O.Faheem]

Hi,

Thanks for your reply.

For my understanding Cortex XSIAM unifies best-in-class functions such as Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), Security Orchestration, Automation, and Response (SOAR), Attack Surface Management (ASM), and more within a single platform. 

So, if these features are there then why EDR or XDR is not able to detect in real-time

Regards,

Osama Faheem