Configure Network Filtering on Supervised Devices (Administrator Task) - When your organization manages iOS devices, the administrator can set up the Network Shield feature to block network activity for specific URLs. - Administrator Guide - 8.9 - 9.2 - Cortex XDR Agent - Cortex XDR - Advanced Endpoint Protection - Cortex

Abstract

When your organization manages iOS devices, the administrator can set up the Network Shield feature to block network activity for specific URLs.

When your organization manages iOS devices, the administrator can set up the Network Shield feature to block network activity for specific URLs. The administrator must configure profiles both at the mobile device management (MDM) side, and at the or Cortex XSIAM tenant side.

At the MDM side, configure a payload configuration profile for network filtering.
- Note that some MDMs do not support lookup values in the network extension profile. As a workaround, when the username is not included, a UDID will be used as the username (on Zero-touch registration). When a user manually opens the app for the first time after the initial deployment, and a username has been set for the app in the MDM, that username will be used from the first heartbeat and onwards. For example, a username can be set in the MDM by using lookup values.
At the or Cortex XSIAM tenant side, configure the Block list in the URL filtering section of the malware profile.

Note

We recommend that you configure your environment so that iOS device users cannot remove the Cortex XDR app manually.

Task 1: Configure a payload configuration profile

In your MDM, configure a Content Filter payload for the managed devices. This payload enables the Network Shield feature. Configure the following:

Enable FilterBrowsers and FilterSockets
Set PluginBundleID to the bundle ID of the Cortex XDR agent iOS app: com.paloaltonetworks.cortex.ios
Set mdmVendor to your organization’s MDM vendor, for example: JAMF or Workspace1.
Add the distributionID to the payload (supported only on devices running iOS 17 or higher).
Important
The distributionID is required for Zero-touch registration. Without it, the device user must onboard the app manually.
- When the distributionID is included in the payload, registration is performed in the background when the device user first opens the app, and the user does not need to perform the installation wizard's onboarding procedures.
(Optional, supported only on devices running iOS 17 or higher) If your MDM solution allows you to set dynamic values in payloads (by providing a value such as $USERNAME or $EMAIL), you can define a user name that will be used during automatic registration in background.

The following example shows a sample configuration profile with the required payload settings:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>FilterBrowsers</key>
            <true/>
            <key>FilterSockets</key>
            <true/>
            <key>FilterType</key>
            <string>Plugin</string>
            <key>PayloadDescription</key>
            <string>Configures content filtering settings</string>
            <key>PayloadDisplayName</key>
            <string>Cortex XDR Network Data Filter</string>
            <key>PayloadIdentifier</key>
            <string>com.apple.webcontent-filter.2EF1184F-FC41-4477-BA81-D46AB318D8BB</string>
            <key>PayloadType</key>
            <string>com.apple.webcontent-filter</string>
            <key>PayloadUUID</key>
            <string>2EF1184F-FC41-4477-BA81-D46AB318D8BB</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PluginBundleID</key>
            <string>com.paloaltonetworks.cortex.ios</string>
            <key>UserDefinedName</key>
            <string>Test667016 Filter Config</string>
            <key>VendorConfig</key>
            <dict>
                <key>distributionId</key>
                <string>******4046b24424d9ce252**********</string>
                <key>username</key>
                <string>$USERNAME</string>
                <key>mdmVendor</key>
                <string>JAMF</string>
            </dict>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Network Filter</string>
    <key>PayloadIdentifier</key>
    <string>M-NPGQ47GQG3.9A2AF4B6-BB2C-4956-B599-CAB4C0CCBD6B</string>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>187DABAB-297B-44B9-88FA-B57F0A44088F</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Task 2: Configure a network filtering policy and assign it to devices

On your or Cortex XSIAM tenant, create a new Malware profile, or edit an existing one for iOS devices.
- Ensure that you set URL filtering, Action Mode to Block.
  - Add malicious URLs to the Block List. You can specify exact URLs, or define a range of URLs using wildcards. For example:
    Block a specific URL: www.google.com
    Block all URLs under Google: www.google.com/*
- Ensure that you set Network and EDR Security Module URL filtering to Enabled.
If the Malware profile is not assigned to a prevention policy rule yet, add it to a new or existing policy rule, and ensure that supervised iOS devices are mapped to the policy rule.
To validate that the network filter is enabled on the device, go to the Cortex XDR app Modules screen on the device. The Network Shield tile should display Controlled by admin.

Actions required when disabling a network filter

To disable the network filter, use your MDM to remove the payload configuration profile that enabled the filter from the supervised iOS device.

Actions required when deleting or reinstalling the Cortex XDR app

Before deleting the Cortex XDR app from a supervised device, use your MDM to remove the payload configuration profile that enabled the filter from the supervised iOS device. This will ensure that all processes related to network filtering are terminated correctly, and ensures seamless reinstallation of the app.

Caution