Endpoint Standard: What Type of USB Devices Can Device Management be Used With?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

What type of devices does the Device Management feature support?

Environment

• Endpoint Standard Windows Sensor: 3.6.0.1897 and Higher
• Endpoint Standard MacOS Sensor: 3.5.3.82 and Higher

Resolution

For Windows

• Either the device interface class registered as GUID_DEVINTERFACE_DISK - reference-link
• OR Device Instance ID starts with “Disk” within USBStor - reference-link
• Support Grid Below 

  Device Type	OS Device Type	Interface Type	Supported?
  USB Flash Drive	Disk	USB	Yes
  Built in SD Card Slot	Disk	Unknown	No
  USB SD Card Reader	Disk	USB	Yes
  USB External Hard Disk	Disk	USB	Yes
  Built In CDROM	CDROM	Unknown	No
  USB External CDROM	CDROM	USB	No
  USB External Floppy Disk	DISK	SCSI	No
  USB Magnetic Optical	Unknown	Unknown	No

For MacOS

• The device has mountable volume (generates volume mount attempt intercept)
• AND the device is presented as external,
• AND the device is presented as USB bus device.
• Support Grid Below 

  Device Type	Mountable Volume	Type	Supported?
  USB Flash Drive	Yes	USB	Yes
  USB SD Card Reader	Yes	USB	Yes
  USB External Hard Disk	Yes	USB	Yes
  USB External CDROM	Yes	USB	Yes
  USB External Floppy Disk	Yes	Unknown	Partial(Block Supported)
  USB Magnetic Optical	Unknown	Unknown	Not Tested