Want to test Open EDR, so I had to open a free Account at XCitium.
I installed one client Agent including the EDR package. So far so good.
Then I added a new profile with “External Divice Control” and activated “Block external USB Storage Devices” amd associated it with the client divice.
But it is not working. Still I can connect and access USB storage devices. Do I have to configure more than this?
Apologies for the inconvenience
To further investigate the reported issue, we need the local logs from one of the affected endpoints.
- If you wish us to collect the endpoint logs from our side, please let us know the name of the affected device and make sure Remote Access Support is enabled under Management > Account > Remote Access Support ( Xcitium Remote Access Support, Xcitium, Xcitium ). You may also find the necessary steps listed in the attached document. After this option is enabled, provide us with the name of the affected device on Endpoint Manager portal.
- If you do not wish to provide us with remote access, and if the device communicates with the Xcitium Platform, run the the predefined procedure “Collect Comodo One logs using new CIS report tool” on the affected device - do not forget to provide us with the name of the device so we can identify the output on our side. However, if the device does not communicate with the Xcitium Platform, please download and run the following report tool on the affected device: https://download.comodo.com/cis/download/installs/cisreporttool/cisreporttool.exe . The tool collects both XCC & XCS logs and attempts to upload them to our SFTP (Device name is included in the name of the output). To be able to to identify the logs on our side,
please send the details to our email address email@example.com and provide us with the local name of the affected device for both the case of capturing log for which it was collected
A few questions:
Have you followed this article?
How to restrict the external devices connected to the endpoints.
Are you sure the profile has applied to the endpoint?
Which version of XCS are you using?