Device Control - Administrator Guide - Cortex XDR - Cortex - Security Operations

In Endpoints → Policy management → Extensions → Profiles, select +Add Profile and then select either Create New or Import from File.

Select a Platform and click Device Configuration → Next.

Fill in the General Information.

Assign the profile Name and add an optional Description. The profile Type and Platform are set by Cortex XDR.

Configure Device Configuration.

For each group of device types, select the desired action. To use the default option defined by Palo Alto Networks, leave Use Default selected.

To save your device profile definitions, click Create.

If needed, you can edit, delete, or duplicate your profiles.

(Optional) To define exceptions to your Device Configuration profile, Add a New Exceptions Profile.

Apply Device Control Profiles to Your Endpoints.

In Endpoints → Policy management → Extension → Profiles, select + New Profile or Import from File.

Select Platform and click Device Exceptions → Next.

Fill in the General Information.

Assign the profile Name and add an optional Description. The profile Type and Platform are set by the system.

Configure Device Exceptions.

You can add devices to your allow list according to different sets of identifiers: vendor, product, and serial numbers.

To save your device exceptions profile, click Create.

If needed, you can later edit, delete, or duplicate your profiles.

Apply Device Control Profiles to Your Endpoints.

In Endpoints → Policy management → Extensions → Policy Rules, select + New Policy or Import from File.

Configure settings for the Device Control policy.

1. Assign a policy name and select the platform. You can add a description.

2. Assign the Device Type profile you want to use in this rule.

3. Click Next.

4. Select the target endpoints on which to enforce the policy.

   Use filters or manual endpoint selection to define the exact target endpoints of the policy rules. If exists, the Group Name is filtered according to the groups within your defined user scope.

5. Click Done.

Configure policy hierarchy.

Drag the policies in the desired order of execution. The default policy that enables all devices on all endpoints is always the last one on the page and is applied to endpoints that don’t match the criteria in the other policies.

Save the policy hierarchy.

After the policy is saved and applied to the agents, Cortex XDR enforces the device control policies on your environment.

(Optional) Manage your policy rules.

In the Protection Policy Rules table, you can view and edit the policy you created and the policy hierarchy.

1. View your policy hierarchy.

2. Right-click to View Policy Details, Edit, Save as New, Disable, and Delete.

3. Select one or more policies, right-click and select Export Policies. You can choose to include the associated Policy Targets, Global Exceptions, and endpoint groups.

Monitor device control violations.

After you apply Device Control rules in your environment, you can use the Endpoints → Device Control Violations page to monitor all instances where end users attempted to connect restricted devices or print jobs, and Cortex XDR blocked them on the endpoint. All violation logs are displayed on the page. You can sort the results and use the filters menu to narrow down the results. For each violation event, Cortex XDR logs the following event details, where relevant and available for each device or print job:

If you see a violation for which you’d like to define an exception on the device that triggered it, right-click the violation and select one of the following options:

Tune your device control exceptions.

To better deploy device control in your network and allow further granularity, you can add devices on your network to your allow list and grant them access to your endpoints. Device control exceptions are configured per device and you must select the device category, vendor, and type of permission that you want to allow on the endpoint. Optionally, to limit the exception to a specific device, you can also include the product and/or serial number.

Cortex XDR enables you to configure the following exceptions:

1. Create a Permanent Exception.

   Permanent device control exceptions are managed in the Permanent Exception list and are applied to all devices regardless of the endpoint platform.

   • If you know in advance which device you’d like to allow throughout your network, create a general exception from the list:

     1. Go to Endpoints → Policy Management → Extensions and select Device Permanent Exceptions on the left menu. The list of existing Permanent Exceptions is displayed.

     2. Select Type, Permission, and Vendor.

     3. (Optional) Select a specific product and/or enter a specific serial number for the device.

     4. Click the adjacent arrow and Save. The exception is added to the Permanent Exceptions list and will be applied in the next heartbeat.

   • Otherwise, you can create a permanent exception directly from the violation event that blocked the device in your network:

     1. On the Device Control Violations page, right-click the violation event triggered by the device you want to permanently allow.

     2. Select Add device to permanent exceptions. Review the exception data and change the defaults if necessary.

     3. Click Save.

2. Create a temporary exception.

   1. On the Device Control Violations page, right-click the violation event triggered by the device you want to temporarily allow.

   2. Select Add device to temporary exceptions. Review the exception data and change the defaults if necessary. For example, you can configure the exception to this endpoint only or to all endpoints in your network, or set which device identifiers will be included in the exception.

   3. Configure the exception Time Frame by defining the number of days or number of hours during which the exception will be applied, up to 30 days.

   4. Click Save. The exception is added to the Device Temporary Exceptions list and will be applied in the next heartbeat.

3. Create an exception within a profile.

   1. On the Device Control Violations page, right-click the violation event triggered by the device you want to add to a Device Exceptions profile.

   2. Select the Profile from the list.

   3. Save. The exception is added to the exceptions profile and will be applied in the next heartbeat.

Go to Endpoints → Policy Management → Settings → Device Management.

This is the list of all your custom USB-connected devices.

Create the new device class.

Select +New Device. Set a Name for the new device class, and supply a valid and unique GUID Identifier. For each GUID value, you can define one class type only.

Save.

The new device class is now available in Cortex XDR as all other device classes.