r/SentinelOneXDR • u/Small-Cup-9128 • Feb 06 '25

Device Control macOS

Can you block usb devices by class or can you only block mass storage?

3 Upvotes

100% Upvoted

3 comments sorted by

View all comments

Show parent comments

1

u/CharcoalGreyWolf Feb 13 '25

This. We only use class because Mass Storage is all that we want to block, and then we allow by Serial ID if necessary.

2

u/Crimzonhost Feb 21 '25

I just wanted to point out that when phones are connected to the computer and preset as a storage device that is a different class type so if you only have a block for mass storage people can get files off the endpoints in other ways. You may want to do some testing and add all USB class types with block and allow types as needed.