Add a New Exceptions Profile

Log in to
Cortex
XDR
.
Go to
Endpoints
Policy management
Extension
Profiles
and select
+ New Profile
or
Import from File
.
Select
Platform
and click
Device Exceptions
Next
Fill in the General Information.
Assign the profile
Name
and add an optional
Description
. The profile
Type
and
Platform
are set by the system.
Configure Device Exceptions.
You can add devices to your allow list according to different sets of identifiers-vendor, product, and serial numbers.
(
Disk Drives only
)
Permission
—Select the permissions you want to grant:
Read only
or
Read/Write
.
Type
—Select the Device Type you want to add to the allow list (Disk Drives, CD-Rom, Portable, or Floppy Disk).
Vendor
—Select a specific vendor from the list or enter the vendor ID in hexadecimal code.
(
Optional
)
Product
—Select a specific product (filtered by the selected vendor) to add to your allow list, or add your product ID in hexadecimal code.
(
Optional
)
Serial Number
—Enter a specific serial number (pertaining to the selected product) to add to your allow list. Only devices with this serial number are included in the allow list.
Save your profile.
When you’re done,
Create
your device exceptions profile.
If needed, you can later edit, delete, or duplicate your profiles.
You cannot edit or delete the predefined profiles in
Cortex
XDR
.
Apply Device Control Profiles to Your Endpoints.

Apply Device Control Profiles to Your Endpoints

Log in to
Cortex
XDR
.
Go to
Endpoints
Policy management
Extension
Policy Rules
and select
+ New Policy
or
Import from File
.
When importing a policy, select whether to enable the associated policy targets. Rules within the imported policy are managed as follows:
New rules are added to top of the list.
Default rules override the default rule in the target tenant.
Rules without a defined target are disabled until target is specified.
Configure settings for the Device Control policy.
Assign a policy name and select the platform. You can add a description.
The platform will automatically be assigned to Windows.
Assign the Device Type profile you want to use in this rule.
Click
Next
.
Select the target endpoints on which to enforce the policy.
Use filters or manual endpoint selection to define the exact target endpoints of the policy rules. If exists, the
Group Name
is filtered according to the groups within your defined user scope.
Click
Done
.
Configure policy hierarchy.
Drag and drop the policies in the desired order of execution. The default policy that enables all devices on all endpoints is always the last one on the page and is applied to endpoints that don’t match the criteria in the other policies.
Save
the policy hierarchy.
After the policy is saved and applied to the agents,
Cortex
XDR
enforces the device control policies on your environment.
(
Optional
) Manage your policy rules.
In the
Protection Policy Rules
table: you can view and edit the policy you created and the policy hierarchy.
View your policy hierarchy.
Right-click to
View Policy Details
,
Edit
,
Save as New
,
Disable
, and
Delete
.
Select one ore more policies, right-click and select
Export Policies
. You can choose to include the associated
Policy Targets
,
Global Exceptions
, and endpoint groups.
Monitor device control violations.
After you apply Device Control rules in your environment, use the
Endpoints
Device Control Violations
page to monitor all instances where end users attempted to connect restricted USB-connected devices and
Cortex
XDR
blocked them on the endpoint. All violation logs are displayed on the page. You can sort the results, and use the filters menu to narrow down the results. For each violation event
Cortex
XDR
logs the event details, the platform, and the device details that are available.
If you see a violation for which you’d like to define an exception on the device that triggered it, right-click the violation and select one of the following options:
Add device to permanent exceptions
—To ensure this device is always allowed in your network, select this option to add the device to the Device Permanent Exceptions list.
Add device to temporary exceptions
—To allow this device only temporarily on the selected endpoint or on all endpoints, select this option and set the allowed time frame for the device.
Allow device to a profile exception
—Select this option to allow the device within an existing Device Exceptions profile.
Tune your device control exceptions.
To better deploy device control in your network and allow further granularity, you can add devices on your network to your allow list and grant them access to your endpoints. Device control exceptions are configured per device and you must select the device category, vendor, and type of permission that you want to allow on the endpoint. Optionally, to limit the exception to a specific device, you can also include the product and/or serial number.
Cortex
XDR
enables you to configure the following exceptions:
Exception Name	Description
Permanent Exceptions	Permanent exceptions approve the device in your network across all Device Control policies and profiles. You can create them directly from the violation event that blocked the device, or through the Permanent Exceptions list. Permanent exceptions apply across platforms, allowing the devices on all operating systems. Create a Permanent Exception.
Temporary Exceptions	Temporary exceptions approve the device for a specific time period up to 30 days. You create a temporary exception directly from the violation event that blocked the device. Create a Temporary Exception.
Profile Exceptions	Profile exceptions approve the device in an existing exceptions profile. You create a profile exception directly from the violation event that blocked the device. Create a Profile Exception.
Create a Permanent Exception.
Permanent device control exceptions are managed in the Permanent Exception list and are applied to all devices regardless of the endpoint platform.
If you know in advance which device you’d like to allow throughout your network, create a general exception from the list:
Go to
Endpoints
Policy Management
Extensions
and select
Device Permanent Exceptions
on the left menu. The list of existing Permanent Exceptions is displayed.
Select:
Type
,
Permission
, and
Vendor
.
(
Optional
) Select a specific product and/or enter a specific serial number for the device.
Click the adjacent arrow and
Save
. The exception is added to the Permanent Exceptions list and will be applied in the next heartbeat.
Otherwise, you can create a permanent exception directly from the violation event that blocked the device in your network:
On the
Device Control Violations
page, right-click the violation event triggered by the device you want to permanently allow.
Select
Add device to permanent exceptions
. Review the exception data and change the defaults if necessary.
Click
Save
.
Create a Temporary Exception.
On the
Device Control Violations
page, right-click the violation event triggered by the device you want to temporarily allow.
Select
Add device to temporary exceptions
. Review the exception data and change the defaults if necessary. For example, you can configure the exception to this endpoint only or to all endpoints in your network, or set which device identifiers will be included in the exception.
Configure the exception
TIME FRAME
by defining the number of days or number of hours during which the exception will be applied, up to 30 days.
Click
Save
. The exception is added to the Device Temporary Exceptions list and will be applied in the next heartbeat.
Create an Exception within a Profile.
On the
Device Control Violations
page, right-click the violation event triggered by the device you want to add to a Device Exceptions profile.
Select the
PROFILE
from the list.
Click
Save
. The exception is added to the Exceptions Profile and will be applied in the next heartbeat.

Add a Custom Device Class

Go to
Endpoints
Policy Management
Settings
Device Management
.
This is the list of all your custom USB-connected devices.
Create the new device class.
Select
+New Device
. Set a
Name
for the new device class, supply a valid and unique GUID
Identifier
. For each GUID value you can define one class type only.
Save.
The new device class is now available in
Cortex
XDR
as all other device classes.

Add a Custom User Notification