Table of Contents

• USB control panel
  • View USB device details
  • Create a device exception
  • View what files were written to external USB device

USB control panel

I can access USB control via the Falcon Main view. From here, I can see all the external devices that are attached to all the hosts connected to Falcon. The control panel lets me allow/block different types of external devices.

View USB device details

In the Device control menu, I can manage any USB device. In this case, I selected my SanDisk device at the top.

Create a device exception

By adding a device exception, I can assign it custom read, write, execute (rwx) permissions.

View what files were written to external USB device

Here, I moved the Duo setup executable to my SanDisk USB device to see if Falcon detects this action.

As a result, the file appears under "Files written to USB." This can be useful for detecting when a confidential file is unexpectedly transfered to an external USB. To prevent this from being possible, the administrator should block the ability to use mass storage, as shown here.