Configure the USB Defender Local Policy connector on a SEM agent

10/9/2018 2:32 AM

10/9/2018 2:32 AM

This article applies to Security Event Manager (formerly Log & Event Manager).

It describes how to create and configure the USB Defender Local Policy connector on an agent.

The USB Defender Local Policy connector allows an agent to enforce restrictions on USB devices even while the agent is not connected to the manager. Rather than using rules when disconnected, the connector uses a  list of permitted users or devices. To do this, the agent compares the fields in all USB device "Attached" events to a locally stored whitelist of users or devices. If none of the fields match an entry on the list, the agent detaches the device.

When the agent is connected to the manager via the network, the manager rule also applies. So any devices listed in the local whitelist must also be in the User Defined Group for authorized devices or the rule takes effect and the device detaches even though it was  allowed by the whitelist in the USB Defender local policy. When the agent is connected, both USB Defender Local Policy and the SEM rule are active.

Security Event Manager

To configure the USB Defender Local Policy connector in the HTML5 SEM Events Console (SEM version 6.6 and later):

1. Create a text file with one entry per line.  This file serves as the "local policy."  Each entry can be a username or a USB device ID (from the ExtraneousInfo field of an "Attached" alert).

   Note:  Wildcards (*) are implied in the list.  If trying to add an entry without the full serial number of the device just add up to the PID of the device.  E.g: USB\VID_0000&PID_0000\ instead of USB\VID_0000&PID_0000\*.

   For advanced configuration options, consult the USB Defender Local Policy Advanced Operation page.

2. In the SEM Events Console, click the Nodes tab.
3. Under Refine Results, expand the Type group, and then select the Agent check box.
4. Select an agent, and then click Manage node connectors.
5. In the search box, type USB defender.
6. Select the USB Defender Local Policy connector, and then click Add Connector.
7. In the Name field, enter a new name, or keep the existing name.
8. Click Browse, and then locate and upload the text file you created above, and then click Add.
9. Under Configured connectors, select your connector, and then click Start.

To configure the USB Defender Local Policy connector in the SEM Flash console:

1. Create a text file with one entry per line.  This file serves as the "local policy."  Each entry can be a username or a USB device ID (from the ExtraneousInfo field of an "Attached" alert).
   
   Note:  Wildcards (*) are implied in the list.  If trying to add an entry without the full serial number of the device just add up to the PID of the device.  E.g: USB\VID_0000&PID_0000\ instead of USB\VID_0000&PID_0000\*.
   
   For advanced configuration options, consult the USB Defender Local Policy Advanced Operation page.
2. In the SEM console, click Nodes from the Manage menu.
3. Click the gear icon next to the node to be configured and select Connectors.
4. Enter USB defender in the Refine Results window.
5. In the Nodes window, select the USB Defender Local Policy connector.  Click its gear icon and click New.
6. Click the … button next to the Policy field to browse to the text file you created above and upload your list to the connector.
7. Click the Save button in the UDLP details pane to complete the setup.
8. When the new connector appears in the Connectors list, click the gear next to it and click Start.

Note: The authorized devices in the local whitelist must also be in the UDG for manager’s Detach Unauthorized USB rule or the rule on the manager enforces detachment when the laptop is connected to the network.  In reverse, if you are using a blacklist and the device is in the USB Local Policy and not in the User Defined Group of the rule, the device still detaches.

Having a device or user in one whitelist or blacklist and not in the other is not recommended and results in inconsistent results.