Device control

By default, all external USB and Bluetooth devices are allowed to connect to your Windows and macOS-based Cortex Cloud endpoints, and all print jobs are allowed. To protect endpoints from connecting to removable devices, such as disk drives, CD-ROM drives, floppy disk drives, Bluetooth devices, and other portable devices, that can contain malicious files, Cortex Cloud provides device control. Different types of print jobs can also be blocked.

Using device control, you can:

• (Windows and macOS) Block all supported USB-connected devices for an endpoint group.
• (Windows and macOS) Block a USB device type but add to your allow list a specific vendor from that list that will be accessible from the endpoint.
• (Windows and macOS) Block connections to Classic Bluetooth devices or Low Energy Bluetooth services. These are two different Bluetooth protocols used for short-range wireless connections.

  • Some examples of Classic Bluetooth devices include: laptop computers, tablets, telephones, audio/video devices, wearables, peripherals, imaging devices, health devices, toys, and so on.
  • Some examples of Low Energy Bluetooth devices include: telephone alert status, microphone control, health sensors, insulin delivery, location and navigation, object transfer, and so on.
• Temporarily block only some device types on an endpoint.

  • USB devices (Windows and macOS)
  • Bluetooth devices (Windows and macOS)
• (Windows and macOS from agent 9.2 and later) Block or allow SD Cards connected on the PCI/PCIe bus.
• (Windows and macOS) Block some, or all, print jobs to local or network printers, or to file.
• Operating systems report on devices in different ways. Sometimes, the same BLE device will report different services and interfaces, depending on the host's operating system. This may have an effect on the specific BLE services that are blocked for each operating system.
• Depending on your defined user scope permissions, creating device profiles, policies, exceptions, and violations may be disabled.

The following are prerequisites to enforce device control policy rules on your endpoints:

Platform	Prerequisites
Windows	For VDI: For VMware Horizon, you must disable Sharing → Allow access to removable storage in your VMware Horizon client settings.
Mac	No prerequisites
Linux	Not supported
Android	Not supported
iOS	Not supported

The following limitations apply to device control on your endpoints:

Platform	Device Type	Limitation
Windows	VDI	Virtual environments leverage different stacks that might not be subject to the Device Control policy rules that are enforced by the Cortex XDR agent and, therefore, could lead to USB devices that are allowed to connect to the VDI instance in contrast to the configured policy rules. The Cortex XDR agent provides best-effort enforcement of the Device Control policy rules on VDI instances that are running on physical endpoints where a Cortex XDR agent is not deployed. For Citrix Virtual Apps and Desktops, Cortex Cloud Device Control is supported on generic virtual channels only.
Windows	Bluetooth	Serial number queries are not supported. If a profile is set to block specific Bluetooth Low Energy (BLE) services, Cortex Cloud only blocks the services set to Block, and not the functionality of the entire device. This means that if a device has multiple services, some of them might still be accessible, while others are blocked. Cortex Cloud attempts to aggregate all related BLE services so that they appear under a single logical Bluetooth device control violation report. However, some Bluetooth devices might be reported in a separate violation report due to the way these devices are paired in the Windows operating system and because they reside outside the device container. Cortex Cloud cannot block low energy services or report device control violations on devices that do not report any LE services. The devices can, however, be blocked completely by setting the entire Bluetooth device to Block. Exceptions can only be created when the Vendor field for the device is available in a violation report. Exceptions for specific BLE devices cannot be created from a violation report. Exceptions for such devices can only be created by disabling the the blocked LE services in the policy. If a Bluetooth device vendor is registered as a Vendor (with ID) in the regulatory organization that supervises USB devices, but is not registered as a Bluetooth device, exceptions cannot be created from a violation report. An alternate method for creating an exception is to create a separate profile for the endpoints using the BLE devices, and allow use of specific major and minor classes for these devices.
macOS	Bluetooth	Cortex Cloud cannot block low energy services or report device control violations on devices that do not report any LE services. The devices can, however, be blocked completely by setting the entire Bluetooth device to Block. Exceptions can only be created when the Vendor field for the device is available in a violation report. Exceptions for specific BLE devices cannot be created from a violation report. Exceptions for such devices can only be created by disabling the the blocked LE services in the policy. If a Bluetooth device vendor is registered as a Vendor (with ID) in the regulatory organization that supervises USB devices, but is not registered as a Bluetooth device, exceptions cannot be created from a violation report. An alternate method for creating an exception is to create a separate profile for the endpoints using the BLE devices, and allow use of specific major and minor classes for these devices. In some cases, when LE devices are blocked by XDR, the host's user interface might not reflect this, and they might appear as connected, when in fact they are blocked. In such cases, these devices retain their pairing status, even though they are blocked. Some Apple devices, such as iPhones or iPads, might not be blocked because they employ protocols other than Bluetooth for inter-device communication. Some complex Bluetooth and BLE devices, such as earphones with pre-paired charging cases, may not be blocked.
Linux	-	Not supported
Android	-	Not supported
iOS	-	Not supported

Device control profiles

To apply device control in your organization, define device control profiles that determine which device types Cortex Cloud blocks, and which it permits. There are two types of profiles:

Profile	Description
Configuration Profile	Allow or block these device type groups: Disk Drives (USB-connected) CD-Rom Drives (USB-connected) Floppy Disk Drives (USB-connected) (Windows only) Windows Portable Devices (USB-connected) (Windows only) Bluetooth Devices (block, allow, or custom types) The Custom option includes configuration options for specific Bluetooth Classes (Bluetooth Classic) device types, and for Low Energy Services (Bluetooth Low Energy). When you select an option in Bluetooth Classes, the right pane of the dialog box provides a detailed list of device types that belong to the selected class. You can choose all, or some of the items in this list. SD Cards connected on the PCI/PCIe bus (Windows and macOS from agent 9.2 and later) Print Jobs (all, or custom types) When set to Block, all print jobs sent from the endpoint will be blocked. When set to Custom, the following options are available: Network printer jobs only when outside Corp. network blocks print jobs sent to network printers while the endpoint is not on the corporate network. Network printer jobs (internal/VPN) blocks print jobs sent to network printers while the endpoint is connected to the network via VPN or an internal connection. Local printer jobs blocks print jobs sent to a printer which is directly connected to an endpoint. Printing to file (Windows only) blocks print jobs that are saved as a file. This option only blocks the print driver. For network printer print jobs, ensure that you also configure the Agent Settings profile, Network Location Configuration option. This setting must be set to Enabled, and configured. If you do not enable and configure this setting, all network printer operations will be treated as internal network print jobs. The Print Job option does not block connections to a printer, but blocks print jobs according to the type of print job. You cannot block use of a specific printer with this feature. Any print job that is not sent via the endpoint's printer spooler, such as a file uploaded to a remote software based printing service, will not be blocked. Cortex XDR relies on the device class assigned by the operating system. Add a new device configuration profile. The Cortex XDR agent relies on the device class assigned by the operating system. For Windows endpoints only, you can configure additional device classes. Add a custom device class.
Exceptions Profile	Allow specific devices according to device types and vendor. You can further specify a specific product and/or product serial number. Add a new device exceptions profile.

Device Configuration and Device Exceptions profiles are configured for each operating system separately. After you configure a device control profile, apply device control profiles to your endpoints.

Add a new device configuration profile

1. In Endpoints → Policy management → Extensions → Profiles, select + Add Profile. Then select Create New or Import from File.
2. Select a platform. Select Device Configuration → Next.
3. Complete the general information.

   Assign a profile name. You can add a description. Cortex Cloud sets the profile type and platform.
4. Configure device settings.

   For each device type group, select an action. Leave Use Default selected to use Palo Alto Networks defaults.

   • For Disk Drives, you can allow read-only access.
   • For Print Jobs, select Custom and choose print job types.
   • For Bluetooth Devices, select Custom and choose Bluetooth Classes or Low Energy Services.

   The current default is Use Default (Allow). Palo Alto Networks can change this default.

   To capture USB connect and disconnect events in XQL Search, set Device Configuration to Block. Events are also captured when blocked device groups have permanent or temporary exceptions.
5. Select Create to save the profile.

   You can later edit, delete, or duplicate the profile.

   You cannot edit or delete default Cortex Cloud profiles.
6. Optional: define exceptions in a Device Exceptions profile.
7. Apply the device control profiles to your endpoints.

Add a new device exceptions profile

1. In Endpoints → Policy management → Extensions → Profiles, select + New Profile or Import from File.
2. Select a platform. Select Device Exceptions → Next.
3. Complete the general information.

   Assign a profile name. You can add a description. The system sets the profile type and platform.
4. Configure device exceptions.

   Add devices to the allow list with vendor, product, and serial number identifiers.

   • Type: Select Bluetooth, CD-ROM, Disk Drive, Floppy Disk, or Windows Portable Devices. Windows Portable Devices are Windows-only.
   • Permission: For disk drives, select Read only or Read/Write.
   • Vendor: Select a vendor or enter its hexadecimal vendor ID.
   • Product: Optionally select a vendor product or enter its hexadecimal product ID.
   • Serial Number: Optionally enter a product serial number. Quote serial numbers that end with a space. For example, "K04M1972138 ".
5. Select Create to save the exceptions profile.

   You can later edit, delete, or duplicate the profile.

   You cannot edit or delete predefined Cortex Cloud profiles.
6. Apply the device control profiles to your endpoints.

Apply device control profiles to your endpoints

After defining configuration and exceptions profiles, configure Device Control policies and enforce them on endpoints. Cortex Cloud evaluates policies in page order. The first matching policy applies. If none match, the default policy enables all devices.

1. In Endpoints → Policy management → Extensions → Policy Rules, select + New Policy or Import from File.

   When importing, choose whether to enable associated policy targets. New rules are added first. Default rules override the tenant default. Rules without targets remain disabled.
2. Configure the Device Control policy.

   1. Assign a policy name and platform. You can add a description.
   2. Assign the Device Type profile for this rule.
   3. Select Next.
   4. Select target endpoints.

      Use filters or manual endpoint selection. Group Name filtering respects your user scope.
   5. Select Done.
3. Configure the policy hierarchy.

   Drag policies into execution order. The default policy always remains last. It applies when no other policy matches.
4. Save the policy hierarchy.

   After the policy reaches agents, Cortex Cloud enforces it.
5. Optional: manage policy rules.

   In the Protection Policy Rules table, view and edit policies and their hierarchy.

   1. View the policy hierarchy.
   2. Right-click a policy to view details, edit, save as new, disable, or delete it.
   3. Select policies and choose Export Policies. You can include policy targets, global exceptions, and endpoint groups.
6. Monitor device control violations.

   Use Endpoints → Device Control Violations to view blocked device and print job attempts. Sort results or filter the list.

   Violations can include:

   • ID, timestamp, endpoint host name, platform, agent ID, user name, and IP address.
   • Device type, GUID, vendor ID, vendor, product name, and serial number.
   • Print job type, document name, additional information, major class, minor class, and vendor type.

   Serial numbers are not supported for Bluetooth devices on Windows endpoints.

   Right-click a violation to add the device to permanent exceptions, temporary exceptions, or a profile exception.
7. Tune device control exceptions.

   Allow-list entries require a device category, vendor, and permission. Optionally specify a product or serial number.

   • Permanent exceptions apply across all Device Control policies and profiles. They apply across platforms.
   • Temporary exceptions apply for up to 30 days.
   • Profile exceptions apply within an existing Device Exceptions profile.

   Create a permanent exception

   Permanent exceptions apply to all devices, regardless of endpoint platform.

   If you know the device in advance:

   1. Go to Endpoints → Policy Management → Extensions → Device Permanent Exceptions.
   2. Select the type, permission, and vendor.
   3. Optional: select a product or enter a serial number.
   4. Select the adjacent arrow and then Save.

   The exception applies at the next heartbeat.

   To create one from a violation:

   1. On Device Control Violations, right-click the relevant violation.
   2. Select Add device to permanent exceptions.
   3. Review the data and select Save.

   Create a temporary exception

   1. On Device Control Violations, right-click the relevant violation.
   2. Select Add device to temporary exceptions.
   3. Review the data. Choose the target endpoints and identifiers.
   4. Set a time frame of up to 30 days.
   5. Select Save.

   The exception applies at the next heartbeat.

   Create an exception within a profile

   1. On Device Control Violations, right-click the relevant violation.
   2. Select the profile.
   3. Select Save.

   The exception applies at the next heartbeat.

Add a custom device class

Windows only: add USB-connected device classes beyond Disk Drive, CD-ROM, Windows Portable Devices, and Floppy Disk Drives. For example, add USB-connected network adapters.

Supply the official ClassGuid identifier from Microsoft. If a device has a configured GUID value, use that value.

After adding a class, view it in Device Management. You can enforce device control rules and exceptions for it.

1. Go to Endpoints → Policy Management → Settings → Device Management.

   This page lists custom USB-connected devices.
2. Select + New Device.

   Set a name and a valid, unique GUID Identifier. Each GUID can define only one class type.
3. Select Save.

The new class is available with other Cortex Cloud device classes.

Add a custom user notification

Personalize the Cortex Cloud endpoint notification shown when users connect blocked USB devices. You can also customize notifications for read-only devices.

Configure notifications in the Agent Settings profile.

Disabling Device Control Violation notifications requires Cortex XDR agent version 8.6 or later.

Ingest connect and disconnect events of USB devices

XQL ingests USB connect and disconnect events reported by the agent. Set the endpoint profile's Device Configuration to Block to capture these events. Events are also captured for blocked device groups with permanent or temporary exceptions.

Use XQL Search with the xdr_data dataset to:

• Display devices by vendor ID, vendor name, product ID, and product name.
• Find hosts connected to a device by serial number.
• Find USB devices connected to specific hosts or host groups.

The following query returns action_device_usb_product_name for USB plug events:

dataset = xdr_data
| filter event_type = DEVICE and event_sub_type = DEVICE_PLUG
| fields action_device_usb_product_name

The following query returns action_device_usb_vendor_name from the device_control preset:

preset = device_control
| filter event_type = DEVICE
| fields action_device_usb_vendor_name